--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8357e27262dbde460a372c56a3cf8b2a4460727e9f4d289c676dc50678e7530c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/08689f9e463b480c27e891b6f19e8af527ae66e8458a4e4b078f21e4ca509a3c"}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8357e27262dbde460a372c56a3cf8b2a4460727e9f4d289c676dc50678e7530c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"08689f9e463b480c27e891b6f19e8af527ae66e8458a4e4b078f21e4ca509a3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["08689f9e463b480c27e891b6f19e8af527ae66e8458a4e4b078f21e4ca509a3c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"08689f9e463b480c27e891b6f19e8af527ae66e8458a4e4b078f21e4ca509a3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8357e27262dbde460a372c56a3cf8b2a4460727e9f4d289c676dc50678e7530c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"08689f9e463b480c27e891b6f19e8af527ae66e8458a4e4b078f21e4ca509a3c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1391a0421eb599f7a377fbf2fb750ea2933a0c0fdd4023ef6cb0bd146c62773c"}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8357e27262dbde460a372c56a3cf8b2a4460727e9f4d289c676dc50678e7530c"}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf"}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/08689f9e463b480c27e891b6f19e8af527ae66e8458a4e4b078f21e4ca509a3c"}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf"}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e"}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e"}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e"}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"}
{"level":"error","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf"}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e"}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"681bd13c1c777f3faa8c693f087d72eef9e960a212d4a9129a6a158a94044b0a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/681bd13c1c777f3faa8c693f087d72eef9e960a212d4a9129a6a158a94044b0a"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"681bd13c1c777f3faa8c693f087d72eef9e960a212d4a9129a6a158a94044b0a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"681bd13c1c777f3faa8c693f087d72eef9e960a212d4a9129a6a158a94044b0a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["681bd13c1c777f3faa8c693f087d72eef9e960a212d4a9129a6a158a94044b0a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/681bd13c1c777f3faa8c693f087d72eef9e960a212d4a9129a6a158a94044b0a"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"681bd13c1c777f3faa8c693f087d72eef9e960a212d4a9129a6a158a94044b0a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/681bd13c1c777f3faa8c693f087d72eef9e960a212d4a9129a6a158a94044b0a"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"681bd13c1c777f3faa8c693f087d72eef9e960a212d4a9129a6a158a94044b0a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c"}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:36:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c"}
{"level":"error","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:36:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:56186","PortSpecifier":{"PortValue":56186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"309ce48b-32dc-428a-985e-b1f8e7492441","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:56186","PortSpecifier":{"PortValue":56186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654592,"nanos":869950667},"http":{"id":"309ce48b-32dc-428a-985e-b1f8e7492441","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/auth-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"309ce48b-32dc-428a-985e-b1f8e7492441","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40250","PortSpecifier":{"PortValue":40250}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40250","PortSpecifier":{"PortValue":40250}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654592,"nanos":933694315},"http":{"id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/auth-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:36:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8c385382-0019-4db0-a9f9-c7d6c0996a4b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:56200","PortSpecifier":{"PortValue":56200}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","method":"GET","path":"/maas-api/v1/api-keys/1016442d-903b-4aab-be25-335be4e4ef3a","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:56200","PortSpecifier":{"PortValue":56200}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654592,"nanos":998580459},"http":{"id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","method":"GET","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/1016442d-903b-4aab-be25-335be4e4ef3a",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/1016442d-903b-4aab-be25-335be4e4ef3a",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/auth-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d8d14cc-6034-4338-a439-98bb1fecf95c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40256","PortSpecifier":{"PortValue":40256}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d414eabe-9d62-4964-9326-49ed582d4e1b","method":"GET","path":"/maas-api/v1/api-keys/f7fc2596-f4a0-4038-9cc5-2e780a75b65d","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40256","PortSpecifier":{"PortValue":40256}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654593,"nanos":42800752},"http":{"id":"d414eabe-9d62-4964-9326-49ed582d4e1b","method":"GET","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/f7fc2596-f4a0-4038-9cc5-2e780a75b65d",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/f7fc2596-f4a0-4038-9cc5-2e780a75b65d",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/auth-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:36:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d414eabe-9d62-4964-9326-49ed582d4e1b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1526d73c-0907-435b-9710-96ddb0995402","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53260","PortSpecifier":{"PortValue":53260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1526d73c-0907-435b-9710-96ddb0995402","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1526d73c-0907-435b-9710-96ddb0995402","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53260","PortSpecifier":{"PortValue":53260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654620,"nanos":496672210},"http":{"id":"1526d73c-0907-435b-9710-96ddb0995402","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1526d73c-0907-435b-9710-96ddb0995402","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1526d73c-0907-435b-9710-96ddb0995402","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1526d73c-0907-435b-9710-96ddb0995402","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1526d73c-0907-435b-9710-96ddb0995402","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1526d73c-0907-435b-9710-96ddb0995402","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1526d73c-0907-435b-9710-96ddb0995402","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/auth-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1526d73c-0907-435b-9710-96ddb0995402","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1526d73c-0907-435b-9710-96ddb0995402","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1526d73c-0907-435b-9710-96ddb0995402","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1526d73c-0907-435b-9710-96ddb0995402","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1526d73c-0907-435b-9710-96ddb0995402","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38824","PortSpecifier":{"PortValue":38824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38824","PortSpecifier":{"PortValue":38824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654620,"nanos":537195073},"http":{"id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/auth-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2fbdbb9a-03f7-4fcc-9b2c-2aee40f102aa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53268","PortSpecifier":{"PortValue":53268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d0d55819-a44d-407e-8bd4-151711838ce5","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53268","PortSpecifier":{"PortValue":53268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654620,"nanos":576993203},"http":{"id":"d0d55819-a44d-407e-8bd4-151711838ce5","method":"GET","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bJtCiHF47De2ghCM_NpSRPQmjKYU5TbfaXq4u10X3PyTs5oCqlZTpiyopJAz"}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bJtCiHF47De2ghCM_NpSRPQmjKYU5TbfaXq4u10X3PyTs5oCqlZTpiyopJAz\"}"}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5a800754-f6ba-44fc-9d9d-dccfa1d42af0","keyName":"e2e-auth-iso-a-6fea7c","subscription":"e2e-auth-iso-4d4758","tenant":"e2e-shared-a-a7b338","userId":"5a800754-f6ba-44fc-9d9d-dccfa1d42af0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/auth-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-4d4758"}
{"level":"info","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:37:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0d55819-a44d-407e-8bd4-151711838ce5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"710e777a-457d-4018-9f91-75b83ed8e551","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36946","PortSpecifier":{"PortValue":36946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"710e777a-457d-4018-9f91-75b83ed8e551","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"710e777a-457d-4018-9f91-75b83ed8e551","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36946","PortSpecifier":{"PortValue":36946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654641,"nanos":620546714},"http":{"id":"710e777a-457d-4018-9f91-75b83ed8e551","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"710e777a-457d-4018-9f91-75b83ed8e551","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"710e777a-457d-4018-9f91-75b83ed8e551","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"710e777a-457d-4018-9f91-75b83ed8e551","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"710e777a-457d-4018-9f91-75b83ed8e551","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"710e777a-457d-4018-9f91-75b83ed8e551","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"710e777a-457d-4018-9f91-75b83ed8e551","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/auth-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"710e777a-457d-4018-9f91-75b83ed8e551","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"710e777a-457d-4018-9f91-75b83ed8e551","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"710e777a-457d-4018-9f91-75b83ed8e551","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"710e777a-457d-4018-9f91-75b83ed8e551","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"710e777a-457d-4018-9f91-75b83ed8e551","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45768","PortSpecifier":{"PortValue":45768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45768","PortSpecifier":{"PortValue":45768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654641,"nanos":655089917},"http":{"id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/auth-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"481e6ba2-2a03-4843-af32-5e6bc4be2af3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e97e86a8-a36b-4c4c-b17c-cd0c5b1e9870","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45780","PortSpecifier":{"PortValue":45780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e97e86a8-a36b-4c4c-b17c-cd0c5b1e9870","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e97e86a8-a36b-4c4c-b17c-cd0c5b1e9870","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45780","PortSpecifier":{"PortValue":45780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654641,"nanos":691714593},"http":{"id":"e97e86a8-a36b-4c4c-b17c-cd0c5b1e9870","method":"GET","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e97e86a8-a36b-4c4c-b17c-cd0c5b1e9870","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-DatIMGGpgQVZjPZR_ag7gklhDelxJNR70MJbLSGMg7dFN2G8eKXKJMRDUGqt"}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e97e86a8-a36b-4c4c-b17c-cd0c5b1e9870","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-DatIMGGpgQVZjPZR_ag7gklhDelxJNR70MJbLSGMg7dFN2G8eKXKJMRDUGqt\"}"}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e97e86a8-a36b-4c4c-b17c-cd0c5b1e9870","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key not found","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e97e86a8-a36b-4c4c-b17c-cd0c5b1e9870","input":{"auth":{"identity":"Bearer **** not found","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e97e86a8-a36b-4c4c-b17c-cd0c5b1e9870","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"e97e86a8-a36b-4c4c-b17c-cd0c5b1e9870","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e97e86a8-a36b-4c4c-b17c-cd0c5b1e9870","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-10T03:37:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e97e86a8-a36b-4c4c-b17c-cd0c5b1e9870","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"application/json"},{"x-ext-auth-reason":""}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50516","PortSpecifier":{"PortValue":50516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50516","PortSpecifier":{"PortValue":50516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654662,"nanos":732394913},"http":{"id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/auth-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8c18d95-0684-46db-8b34-72e777e5ec0f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:59132","PortSpecifier":{"PortValue":59132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:59132","PortSpecifier":{"PortValue":59132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654662,"nanos":771570457},"http":{"id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/auth-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9309f8be-dfe5-4f26-9fb6-69ac7797fbdc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50524","PortSpecifier":{"PortValue":50524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50524","PortSpecifier":{"PortValue":50524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654662,"nanos":812281152},"http":{"id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/auth-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"08950c41-9eb5-4634-b5a9-2783de7bf2a5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fde38334-c8b2-46b5-b916-371d32787784","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:59140","PortSpecifier":{"PortValue":59140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fde38334-c8b2-46b5-b916-371d32787784","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fde38334-c8b2-46b5-b916-371d32787784","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:59140","PortSpecifier":{"PortValue":59140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654662,"nanos":846815905},"http":{"id":"fde38334-c8b2-46b5-b916-371d32787784","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fde38334-c8b2-46b5-b916-371d32787784","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fde38334-c8b2-46b5-b916-371d32787784","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fde38334-c8b2-46b5-b916-371d32787784","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fde38334-c8b2-46b5-b916-371d32787784","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fde38334-c8b2-46b5-b916-371d32787784","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fde38334-c8b2-46b5-b916-371d32787784","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/auth-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fde38334-c8b2-46b5-b916-371d32787784","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fde38334-c8b2-46b5-b916-371d32787784","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fde38334-c8b2-46b5-b916-371d32787784","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fde38334-c8b2-46b5-b916-371d32787784","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:37:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fde38334-c8b2-46b5-b916-371d32787784","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"86807903-cfab-411c-8c10-631f24cdeb24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44520","PortSpecifier":{"PortValue":44520}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"86807903-cfab-411c-8c10-631f24cdeb24","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"86807903-cfab-411c-8c10-631f24cdeb24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44520","PortSpecifier":{"PortValue":44520}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654686,"nanos":8033042},"http":{"id":"86807903-cfab-411c-8c10-631f24cdeb24","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"86807903-cfab-411c-8c10-631f24cdeb24","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"86807903-cfab-411c-8c10-631f24cdeb24","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"86807903-cfab-411c-8c10-631f24cdeb24","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"86807903-cfab-411c-8c10-631f24cdeb24","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"86807903-cfab-411c-8c10-631f24cdeb24","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"86807903-cfab-411c-8c10-631f24cdeb24","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/auth-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"86807903-cfab-411c-8c10-631f24cdeb24","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"86807903-cfab-411c-8c10-631f24cdeb24","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"86807903-cfab-411c-8c10-631f24cdeb24","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"86807903-cfab-411c-8c10-631f24cdeb24","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"86807903-cfab-411c-8c10-631f24cdeb24","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53942","PortSpecifier":{"PortValue":53942}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53942","PortSpecifier":{"PortValue":53942}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654686,"nanos":47348418},"http":{"id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/auth-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f7f6afd-7523-4d3c-a1be-cae224d0b39e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53948","PortSpecifier":{"PortValue":53948}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","method":"GET","path":"/maas-api/v1/api-keys/0a70f7b5-6c6e-4452-91b0-526dac8d97a5","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53948","PortSpecifier":{"PortValue":53948}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654686,"nanos":83924527},"http":{"id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","method":"GET","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/0a70f7b5-6c6e-4452-91b0-526dac8d97a5",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/0a70f7b5-6c6e-4452-91b0-526dac8d97a5",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/auth-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5bc23f8d-a084-4af6-88a2-4132fe1b86ab","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44536","PortSpecifier":{"PortValue":44536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05044881-ff13-4772-a5d1-e31436ee1cf7","method":"GET","path":"/maas-api/v1/api-keys/0a70f7b5-6c6e-4452-91b0-526dac8d97a5","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44536","PortSpecifier":{"PortValue":44536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654686,"nanos":113832130},"http":{"id":"05044881-ff13-4772-a5d1-e31436ee1cf7","method":"GET","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/0a70f7b5-6c6e-4452-91b0-526dac8d97a5",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/0a70f7b5-6c6e-4452-91b0-526dac8d97a5",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/auth-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:38:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05044881-ff13-4772-a5d1-e31436ee1cf7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33910","PortSpecifier":{"PortValue":33910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"add9979d-b8c5-449a-a233-e75da2472fa4","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33910","PortSpecifier":{"PortValue":33910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654711,"nanos":487284759},"http":{"id":"add9979d-b8c5-449a-a233-e75da2472fa4","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/auth-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"add9979d-b8c5-449a-a233-e75da2472fa4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54050","PortSpecifier":{"PortValue":54050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54050","PortSpecifier":{"PortValue":54050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654711,"nanos":528304569},"http":{"id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/auth-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6522c1d7-8ddd-4ff0-a1dc-6cfc3a8f5404","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33920","PortSpecifier":{"PortValue":33920}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33920","PortSpecifier":{"PortValue":33920}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654711,"nanos":566926283},"http":{"id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dhMr2zupVBpY8fvB_pOyaJxQFktW8j5dFKuhGcGaHrhJxTujYUIYpd6Q34NE"}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dhMr2zupVBpY8fvB_pOyaJxQFktW8j5dFKuhGcGaHrhJxTujYUIYpd6Q34NE\"}"}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf5306c5-d017-4b22-b433-c997ea06c251","keyName":"e2e-auth-iso-a-da2a22","subscription":"e2e-auth-iso-6fbe8c","tenant":"e2e-shared-a-a7b338","userId":"bf5306c5-d017-4b22-b433-c997ea06c251","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/auth-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-6fbe8c"}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:38:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ba1edbdd-ddfc-4017-bdee-7cbbe0e94602","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271"}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271"}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271"}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271"}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271"}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271"}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35"}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35"}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/681bd13c1c777f3faa8c693f087d72eef9e960a212d4a9129a6a158a94044b0a"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/79293ad5e62546bfba498cc2b640b4c8fcdd7e7ead25551f45829946550b862c"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c"}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:38:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/37f60f71a8cfb258fcc3f405e8cdc3db04ed81802c73121adb842553aef761bf"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a3e1aa7b822786e347b1291fe126c31e1966079d2059f9a9688cb31f97c01de6"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1114b229037e9262c06dcd14da6f5bccf40248c733bc338bd3d095767c8700f6"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/271354a971222e2bbb372dc21486fc54e92a10b729f7a40ffed39bcfd4658c12"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e916ce55aa5afedaf1328f2c51565500035bfafd444a143c0273863c942ef14d"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1391a0421eb599f7a377fbf2fb750ea2933a0c0fdd4023ef6cb0bd146c62773c"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5f6a021449e1374430b146b7dd15045ef5aca40879cbd3d5505b7e80856ace8c"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/02f49f26701fbff71d583b0a83be104de763237fbf9fcccad77770182fe20275"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/24c4bd72e029fa14acea3720cdf4b60be57b7b105fc5410b353e502d349d885e"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3e6ba2bbc7adf6f6e5aae46d3f73910f7d75107e9210ec01092648933cd08a6e"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/08689f9e463b480c27e891b6f19e8af527ae66e8458a4e4b078f21e4ca509a3c"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6899e88fd9e1c59c9e6544edf88b30199105bf5699c43d96427d7d7c3579478e"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b82c0c86b38e28869b6a7ad49bd53f6e9403037b1eb1c9480dafb671b6e6e984"}
{"level":"info","ts":"2026-07-10T03:38:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d8aa87654ab9a6e7e31a4d308124e3b33500e7a19b941c731ae70023c3710873"}
{"level":"debug","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"debug","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"debug","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"debug","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"debug","ts":"2026-07-10T03:39:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0"}
{"level":"debug","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0"}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0"}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0"}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0"}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988"}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988"}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8"}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8"}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988"}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8"}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8"}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8"}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d"}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d"}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d"}
{"level":"debug","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271"}
{"level":"debug","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7"}
{"level":"debug","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7"}
{"level":"debug","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144"}
{"level":"debug","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7"}
{"level":"info","ts":"2026-07-10T03:39:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4389775adb21d7184e8a0d6c5a81915c81d5faf262d86c8d946301e1bddba1ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4389775adb21d7184e8a0d6c5a81915c81d5faf262d86c8d946301e1bddba1ab"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8"}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727"}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727"}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727"}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf"}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d"}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf"}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:39:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:39:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a"}
{"level":"error","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"}
{"level":"debug","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8357e27262dbde460a372c56a3cf8b2a4460727e9f4d289c676dc50678e7530c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf"}
{"level":"debug","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df82d9f85001d79a5f59cdca1f8364463e2422d110ef0daefd1b7ec028a38a77","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"info","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988"}
{"level":"info","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8357e27262dbde460a372c56a3cf8b2a4460727e9f4d289c676dc50678e7530c"}
{"level":"debug","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07a19985014a0dd0a51211350bfa7603a07c2f12a2abad927a26f0538970b4e9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35"}
{"level":"debug","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df82d9f85001d79a5f59cdca1f8364463e2422d110ef0daefd1b7ec028a38a77"}
{"level":"info","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c"}
{"level":"info","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07a19985014a0dd0a51211350bfa7603a07c2f12a2abad927a26f0538970b4e9"}
{"level":"info","ts":"2026-07-10T03:39:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c"}
{"level":"info","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55070","PortSpecifier":{"PortValue":55070}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"34a88181-c140-4639-aeb4-5b2ee991d50f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55070","PortSpecifier":{"PortValue":55070}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654799,"nanos":388364177},"http":{"id":"34a88181-c140-4639-aeb4-5b2ee991d50f","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/sub-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"34a88181-c140-4639-aeb4-5b2ee991d50f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"155012a4-40ff-4ab3-a425-655f36d32262","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34814","PortSpecifier":{"PortValue":34814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"155012a4-40ff-4ab3-a425-655f36d32262","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"155012a4-40ff-4ab3-a425-655f36d32262","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34814","PortSpecifier":{"PortValue":34814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654799,"nanos":431101438},"http":{"id":"155012a4-40ff-4ab3-a425-655f36d32262","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"155012a4-40ff-4ab3-a425-655f36d32262","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"155012a4-40ff-4ab3-a425-655f36d32262","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"155012a4-40ff-4ab3-a425-655f36d32262","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"155012a4-40ff-4ab3-a425-655f36d32262","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"155012a4-40ff-4ab3-a425-655f36d32262","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"155012a4-40ff-4ab3-a425-655f36d32262","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/sub-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"155012a4-40ff-4ab3-a425-655f36d32262","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"155012a4-40ff-4ab3-a425-655f36d32262","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"155012a4-40ff-4ab3-a425-655f36d32262","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"155012a4-40ff-4ab3-a425-655f36d32262","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"155012a4-40ff-4ab3-a425-655f36d32262","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"608c46d7-af8c-409d-a1e9-843812862d45","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55076","PortSpecifier":{"PortValue":55076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"608c46d7-af8c-409d-a1e9-843812862d45","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"608c46d7-af8c-409d-a1e9-843812862d45","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55076","PortSpecifier":{"PortValue":55076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654799,"nanos":473658282},"http":{"id":"608c46d7-af8c-409d-a1e9-843812862d45","method":"GET","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"608c46d7-af8c-409d-a1e9-843812862d45","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-u0KyrsHZKZ2Mkl8a_oMLp1ruPG5MBTfJIXlvkMhAgywHb474c7ZtYqLrouDy"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"608c46d7-af8c-409d-a1e9-843812862d45","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-u0KyrsHZKZ2Mkl8a_oMLp1ruPG5MBTfJIXlvkMhAgywHb474c7ZtYqLrouDy\"}"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"608c46d7-af8c-409d-a1e9-843812862d45","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ea45aa66-892a-4171-8716-03cb1a38c3db","keyName":"e2e-sub-iso-373788","subscription":"e2e-a-only-62dec5","tenant":"e2e-shared-a-a7b338","userId":"ea45aa66-892a-4171-8716-03cb1a38c3db","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"608c46d7-af8c-409d-a1e9-843812862d45","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"608c46d7-af8c-409d-a1e9-843812862d45","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"608c46d7-af8c-409d-a1e9-843812862d45","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"608c46d7-af8c-409d-a1e9-843812862d45","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/sub-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"608c46d7-af8c-409d-a1e9-843812862d45","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"608c46d7-af8c-409d-a1e9-843812862d45","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-a-only-62dec5"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"608c46d7-af8c-409d-a1e9-843812862d45","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"608c46d7-af8c-409d-a1e9-843812862d45","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"608c46d7-af8c-409d-a1e9-843812862d45","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"608c46d7-af8c-409d-a1e9-843812862d45","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34816","PortSpecifier":{"PortValue":34816}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34816","PortSpecifier":{"PortValue":34816}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654799,"nanos":515883013},"http":{"id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","method":"GET","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-NPWl0EFm8sylZZmY_J0SML5kdlf3R7c1IxyqIzZMTsT4AoDc43vomKvXGeAy"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-NPWl0EFm8sylZZmY_J0SML5kdlf3R7c1IxyqIzZMTsT4AoDc43vomKvXGeAy\"}"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c4e7da7a-b3b2-4a06-a9ec-736b9ce5f5ce","keyName":"e2e-sub-iso-0c3853","subscription":"e2e-b-only-62dec5","tenant":"e2e-shared-b-17c732","userId":"c4e7da7a-b3b2-4a06-a9ec-736b9ce5f5ce","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/sub-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-b-only-62dec5"}
{"level":"info","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:39:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ad4bdcb-14e9-4672-bd10-ab336c73b419","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:51988","PortSpecifier":{"PortValue":51988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:51988","PortSpecifier":{"PortValue":51988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654828,"nanos":803394127},"http":{"id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/sub-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3ee576e-2936-4b3f-8eb8-4490c9ed8f5a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:43900","PortSpecifier":{"PortValue":43900}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"84edb2e8-aea0-4244-8321-422f4b35da8b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:43900","PortSpecifier":{"PortValue":43900}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654828,"nanos":840807163},"http":{"id":"84edb2e8-aea0-4244-8321-422f4b35da8b","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/sub-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84edb2e8-aea0-4244-8321-422f4b35da8b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:52002","PortSpecifier":{"PortValue":52002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:52002","PortSpecifier":{"PortValue":52002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654828,"nanos":874417046},"http":{"id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1R7w7Ne1AzfV4ZWsV_7ZUbMQTUARQDdkpx06AncoJVmnPbLLQkFXIwldwKmQ6"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1R7w7Ne1AzfV4ZWsV_7ZUbMQTUARQDdkpx06AncoJVmnPbLLQkFXIwldwKmQ6\"}"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"717455c0-c259-4132-9e7c-238d7fb67321","keyName":"e2e-sub-iso-b373a7","subscription":"e2e-shared-sub-cd2087","tenant":"e2e-shared-a-a7b338","userId":"717455c0-c259-4132-9e7c-238d7fb67321","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/sub-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-cd2087"}
{"level":"info","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"519edf8c-ccd5-45bf-8a87-2f1bce02a923","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:43906","PortSpecifier":{"PortValue":43906}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"23f3877f-724a-4e78-bc62-2106a05079ac","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:43906","PortSpecifier":{"PortValue":43906}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654828,"nanos":904006228},"http":{"id":"23f3877f-724a-4e78-bc62-2106a05079ac","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1aV6zsrQR0JVDAEqW_fZPuaEBzND3sNmABMPbxWbJsClfXIMcMbF4OZ1sLB3X"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1aV6zsrQR0JVDAEqW_fZPuaEBzND3sNmABMPbxWbJsClfXIMcMbF4OZ1sLB3X\"}"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f3ecd923-c7c0-44d2-887b-13b2b6e9ee82","keyName":"e2e-sub-iso-4cfc68","subscription":"e2e-shared-sub-cd2087","tenant":"e2e-shared-b-17c732","userId":"f3ecd923-c7c0-44d2-887b-13b2b6e9ee82","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/sub-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-cd2087"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:40:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23f3877f-724a-4e78-bc62-2106a05079ac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:40:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/68b4bafe1a302e49a7023c4049068be30368ecb30dd93d4ca49d0615f4cc73a7"}
{"level":"info","ts":"2026-07-10T03:40:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a5756a8423c26bc6e6e12bf82f529f1e166f4b23f9cd943cbfca4b39a03e6f35"}
{"level":"info","ts":"2026-07-10T03:40:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9cc47da23cb698a5dedd276b5e9c76671376cfb17444105432e880949b5e948c"}
{"level":"info","ts":"2026-07-10T03:40:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a3e8a3e01caa070afb8eab4ed8bc4d81cb128ab089550ac1e055c51d37c1e24d"}
{"level":"info","ts":"2026-07-10T03:40:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d00e374a848eec48039ae5f6f4f6f154e471e63a0f04baf0fad2bdd522418a8e"}
{"level":"info","ts":"2026-07-10T03:40:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/91e0d848b1331fac466b33eae002a7272711c15a8f90067da3cace161729c5d8"}
{"level":"info","ts":"2026-07-10T03:40:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/98220ff393f07018c2372f2949e60b9a112dc1b1bfb1b589648713f03bfa4a6a"}
{"level":"info","ts":"2026-07-10T03:40:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dd6afa7f673768584add3349dbc62d6845050d22e84f68061a45221184812727"}
{"level":"info","ts":"2026-07-10T03:40:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9f77628e3268bf8f1da96d45ebd8eef99e6bbd324ace97e49100ef0240fae7f7"}
{"level":"info","ts":"2026-07-10T03:40:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df532bab8c0d7c683942fe81169acb672e1ec71c4c17cbcb2048128016caee2d"}
{"level":"info","ts":"2026-07-10T03:40:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a4b14c33bb47b4efacea4eb660b1366ed85fbae97ef4e23dd6a365e9b5bf2988"}
{"level":"info","ts":"2026-07-10T03:40:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dd2526899be9cc6230d15164db5a1bc26afdc86fc25b154c0a0ca2047e6f6494"}
{"level":"info","ts":"2026-07-10T03:40:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/63d17d09e2a82ac23beaecbf0554fdee5c907a1e4d7552aa580417c2d11911a0"}
{"level":"info","ts":"2026-07-10T03:40:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e4c798541cb94b2906d0c9f3f5bb167b4a38a588002a7fac783b958af6d2adcf"}
{"level":"info","ts":"2026-07-10T03:40:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d007ff048f43f1589f21bbc6420a93e5ff80d3c3cef7f6ded71968ff772c9144"}
{"level":"info","ts":"2026-07-10T03:40:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/de32543451bc079e68d3ccaccd13de1d1c0af282a2125d268015d6a7a9c52271"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"}
{"level":"error","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d"}
{"level":"debug","ts":"2026-07-10T03:41:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d"}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe"}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe"}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe"}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead"}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead"}
{"level":"error","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"error","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead"}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"debug","ts":"2026-07-10T03:41:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde"}
{"level":"debug","ts":"2026-07-10T03:41:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92"}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde"}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c"}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c"}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"}
{"level":"debug","ts":"2026-07-10T03:41:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97"}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97"}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97"}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113"}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113"}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113"}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb"}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb"}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb"}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb"}
{"level":"debug","ts":"2026-07-10T03:41:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb"}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07a19985014a0dd0a51211350bfa7603a07c2f12a2abad927a26f0538970b4e9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07a19985014a0dd0a51211350bfa7603a07c2f12a2abad927a26f0538970b4e9"}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c"}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4389775adb21d7184e8a0d6c5a81915c81d5faf262d86c8d946301e1bddba1ab","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c"}
{"level":"info","ts":"2026-07-10T03:41:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4389775adb21d7184e8a0d6c5a81915c81d5faf262d86c8d946301e1bddba1ab"}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92"}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T03:41:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T03:41:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T03:41:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T03:41:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97"}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df82d9f85001d79a5f59cdca1f8364463e2422d110ef0daefd1b7ec028a38a77","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df82d9f85001d79a5f59cdca1f8364463e2422d110ef0daefd1b7ec028a38a77"}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113"}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca"}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8357e27262dbde460a372c56a3cf8b2a4460727e9f4d289c676dc50678e7530c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8357e27262dbde460a372c56a3cf8b2a4460727e9f4d289c676dc50678e7530c"}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde"}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"debug","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead"}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe"}
{"level":"info","ts":"2026-07-10T03:41:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c"}
{"level":"info","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54712","PortSpecifier":{"PortValue":54712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54712","PortSpecifier":{"PortValue":54712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654909,"nanos":450154526},"http":{"id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46444","PortSpecifier":{"PortValue":46444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46444","PortSpecifier":{"PortValue":46444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654909,"nanos":503463058},"http":{"id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce77162e-df4a-4247-ba24-0b1885547431","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54718","PortSpecifier":{"PortValue":54718}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ce77162e-df4a-4247-ba24-0b1885547431","method":"POST","path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce77162e-df4a-4247-ba24-0b1885547431","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54718","PortSpecifier":{"PortValue":54718}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654909,"nanos":557561074},"http":{"id":"ce77162e-df4a-4247-ba24-0b1885547431","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-16d2rXdHDQBIJ5wJ3_fdeAn1G9W83JeeQLdIpTeVvUD9ynotfJdUeX02Kvxxn"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-16d2rXdHDQBIJ5wJ3_fdeAn1G9W83JeeQLdIpTeVvUD9ynotfJdUeX02Kvxxn\"}"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"531cef05-7085-4ff4-bc9e-1afcb8279111","keyName":"e2e-rate-a-5114d1","subscription":"e2e-rate-iso-a-5114d1","tenant":"e2e-shared-a-a7b338","userId":"531cef05-7085-4ff4-bc9e-1afcb8279111","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\",\"requestedSubscription\":\"e2e-rate-iso-a-5114d1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5114d1","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ce77162e-df4a-4247-ba24-0b1885547431","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5114d1"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"531cef05-7085-4ff4-bc9e-1afcb8279111","keyName":"e2e-rate-a-5114d1","selected_subscription":"e2e-rate-iso-a-5114d1","selected_subscription_key":"ai-tenant-e2e-shared-a-a7b338/e2e-rate-iso-a-5114d1@ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5114d1","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce77162e-df4a-4247-ba24-0b1885547431","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce77162e-df4a-4247-ba24-0b1885547431","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54724","PortSpecifier":{"PortValue":54724}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"721a09b2-45af-4863-8fb9-97c6c342588b","method":"POST","path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54724","PortSpecifier":{"PortValue":54724}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654910,"nanos":618613461},"http":{"id":"721a09b2-45af-4863-8fb9-97c6c342588b","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-16d2rXdHDQBIJ5wJ3_fdeAn1G9W83JeeQLdIpTeVvUD9ynotfJdUeX02Kvxxn"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-16d2rXdHDQBIJ5wJ3_fdeAn1G9W83JeeQLdIpTeVvUD9ynotfJdUeX02Kvxxn\"}"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"531cef05-7085-4ff4-bc9e-1afcb8279111","keyName":"e2e-rate-a-5114d1","subscription":"e2e-rate-iso-a-5114d1","tenant":"e2e-shared-a-a7b338","userId":"531cef05-7085-4ff4-bc9e-1afcb8279111","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\",\"requestedSubscription\":\"e2e-rate-iso-a-5114d1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5114d1","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5114d1"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"531cef05-7085-4ff4-bc9e-1afcb8279111","keyName":"e2e-rate-a-5114d1","selected_subscription":"e2e-rate-iso-a-5114d1","selected_subscription_key":"ai-tenant-e2e-shared-a-a7b338/e2e-rate-iso-a-5114d1@ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5114d1","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc55366a-2591-4983-9151-eceb0448974d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54738","PortSpecifier":{"PortValue":54738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dc55366a-2591-4983-9151-eceb0448974d","method":"POST","path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc55366a-2591-4983-9151-eceb0448974d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54738","PortSpecifier":{"PortValue":54738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654911,"nanos":657590187},"http":{"id":"dc55366a-2591-4983-9151-eceb0448974d","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-16d2rXdHDQBIJ5wJ3_fdeAn1G9W83JeeQLdIpTeVvUD9ynotfJdUeX02Kvxxn"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-16d2rXdHDQBIJ5wJ3_fdeAn1G9W83JeeQLdIpTeVvUD9ynotfJdUeX02Kvxxn\"}"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"531cef05-7085-4ff4-bc9e-1afcb8279111","keyName":"e2e-rate-a-5114d1","subscription":"e2e-rate-iso-a-5114d1","tenant":"e2e-shared-a-a7b338","userId":"531cef05-7085-4ff4-bc9e-1afcb8279111","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\",\"requestedSubscription\":\"e2e-rate-iso-a-5114d1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5114d1","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dc55366a-2591-4983-9151-eceb0448974d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5114d1"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"531cef05-7085-4ff4-bc9e-1afcb8279111","keyName":"e2e-rate-a-5114d1","selected_subscription":"e2e-rate-iso-a-5114d1","selected_subscription_key":"ai-tenant-e2e-shared-a-a7b338/e2e-rate-iso-a-5114d1@ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5114d1","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc55366a-2591-4983-9151-eceb0448974d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc55366a-2591-4983-9151-eceb0448974d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"298a721e-3f40-4671-9d23-0148686634a3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47170","PortSpecifier":{"PortValue":47170}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"298a721e-3f40-4671-9d23-0148686634a3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"298a721e-3f40-4671-9d23-0148686634a3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47170","PortSpecifier":{"PortValue":47170}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654926,"nanos":368651891},"http":{"id":"298a721e-3f40-4671-9d23-0148686634a3","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"298a721e-3f40-4671-9d23-0148686634a3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"298a721e-3f40-4671-9d23-0148686634a3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"298a721e-3f40-4671-9d23-0148686634a3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"298a721e-3f40-4671-9d23-0148686634a3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37508","PortSpecifier":{"PortValue":37508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37508","PortSpecifier":{"PortValue":37508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654926,"nanos":409578570},"http":{"id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"315ae6f7-481b-4702-a704-7ebd31345887","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47176","PortSpecifier":{"PortValue":47176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"315ae6f7-481b-4702-a704-7ebd31345887","method":"POST","path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"315ae6f7-481b-4702-a704-7ebd31345887","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47176","PortSpecifier":{"PortValue":47176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654926,"nanos":444977301},"http":{"id":"315ae6f7-481b-4702-a704-7ebd31345887","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-13tMXtkAvgsIqMzjX_Qrn63rxgmQMCQ9K3iTTvfTKFZrX8AFjCdLDL4bFZfiB"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-13tMXtkAvgsIqMzjX_Qrn63rxgmQMCQ9K3iTTvfTKFZrX8AFjCdLDL4bFZfiB\"}"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","keyName":"e2e-rate-a-c4e089","subscription":"e2e-rate-iso-a-c4e089","tenant":"e2e-shared-a-a7b338","userId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\",\"requestedSubscription\":\"e2e-rate-iso-a-c4e089\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c4e089","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"315ae6f7-481b-4702-a704-7ebd31345887","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c4e089"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","keyName":"e2e-rate-a-c4e089","selected_subscription":"e2e-rate-iso-a-c4e089","selected_subscription_key":"ai-tenant-e2e-shared-a-a7b338/e2e-rate-iso-a-c4e089@ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c4e089","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"315ae6f7-481b-4702-a704-7ebd31345887","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"315ae6f7-481b-4702-a704-7ebd31345887","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47178","PortSpecifier":{"PortValue":47178}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","method":"POST","path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47178","PortSpecifier":{"PortValue":47178}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654927,"nanos":491389854},"http":{"id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-13tMXtkAvgsIqMzjX_Qrn63rxgmQMCQ9K3iTTvfTKFZrX8AFjCdLDL4bFZfiB"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-13tMXtkAvgsIqMzjX_Qrn63rxgmQMCQ9K3iTTvfTKFZrX8AFjCdLDL4bFZfiB\"}"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","keyName":"e2e-rate-a-c4e089","subscription":"e2e-rate-iso-a-c4e089","tenant":"e2e-shared-a-a7b338","userId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\",\"requestedSubscription\":\"e2e-rate-iso-a-c4e089\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c4e089","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c4e089"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","keyName":"e2e-rate-a-c4e089","selected_subscription":"e2e-rate-iso-a-c4e089","selected_subscription_key":"ai-tenant-e2e-shared-a-a7b338/e2e-rate-iso-a-c4e089@ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c4e089","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47188","PortSpecifier":{"PortValue":47188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","method":"POST","path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47188","PortSpecifier":{"PortValue":47188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654928,"nanos":530216098},"http":{"id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-13tMXtkAvgsIqMzjX_Qrn63rxgmQMCQ9K3iTTvfTKFZrX8AFjCdLDL4bFZfiB"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-13tMXtkAvgsIqMzjX_Qrn63rxgmQMCQ9K3iTTvfTKFZrX8AFjCdLDL4bFZfiB\"}"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","keyName":"e2e-rate-a-c4e089","subscription":"e2e-rate-iso-a-c4e089","tenant":"e2e-shared-a-a7b338","userId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\",\"requestedSubscription\":\"e2e-rate-iso-a-c4e089\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c4e089","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c4e089"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","keyName":"e2e-rate-a-c4e089","selected_subscription":"e2e-rate-iso-a-c4e089","selected_subscription_key":"ai-tenant-e2e-shared-a-a7b338/e2e-rate-iso-a-c4e089@ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c4e089","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37512","PortSpecifier":{"PortValue":37512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1f81b97b-68f6-4625-a32e-7be994e76944","method":"POST","path":"/ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732/v1/completions","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37512","PortSpecifier":{"PortValue":37512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654928,"nanos":563619897},"http":{"id":"1f81b97b-68f6-4625-a32e-7be994e76944","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-EmzyEi9neqzJZ4A1_MiXXSKfZquYChNMyVS0IvrH3ekJhiUfEv2jgVSjaS2K"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-EmzyEi9neqzJZ4A1_MiXXSKfZquYChNMyVS0IvrH3ekJhiUfEv2jgVSjaS2K\"}"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f51edf21-0bd1-408c-8ed2-9c53701f2b10","keyName":"e2e-rate-b-c4e089","subscription":"e2e-rate-iso-b-c4e089","tenant":"e2e-shared-b-17c732","userId":"f51edf21-0bd1-408c-8ed2-9c53701f2b10","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732\",\"requestedSubscription\":\"e2e-rate-iso-b-c4e089\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-17c732","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-c4e089","namespace":"ai-tenant-e2e-shared-b-17c732","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-c4e089"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f51edf21-0bd1-408c-8ed2-9c53701f2b10","keyName":"e2e-rate-b-c4e089","selected_subscription":"e2e-rate-iso-b-c4e089","selected_subscription_key":"ai-tenant-e2e-shared-b-17c732/e2e-rate-iso-b-c4e089@ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-17c732","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-c4e089","namespace":"ai-tenant-e2e-shared-b-17c732","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44378","PortSpecifier":{"PortValue":44378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44378","PortSpecifier":{"PortValue":44378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":17617268},"http":{"id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","method":"POST","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44390","PortSpecifier":{"PortValue":44390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44390","PortSpecifier":{"PortValue":44390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":69944129},"http":{"id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","method":"POST","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44392","PortSpecifier":{"PortValue":44392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44392","PortSpecifier":{"PortValue":44392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":108933352},"http":{"id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","method":"POST","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44394","PortSpecifier":{"PortValue":44394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44394","PortSpecifier":{"PortValue":44394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":147057101},"http":{"id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","method":"POST","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44408","PortSpecifier":{"PortValue":44408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44408","PortSpecifier":{"PortValue":44408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":183344210},"http":{"id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4696839a-435f-4055-97af-d18146b66b6f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4696839a-435f-4055-97af-d18146b66b6f","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4696839a-435f-4055-97af-d18146b66b6f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":213899367},"http":{"id":"4696839a-435f-4055-97af-d18146b66b6f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4696839a-435f-4055-97af-d18146b66b6f","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.50","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctajlyYmQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.36~maas-default-gateway-openshift-default-56654dcf7-j9rbd.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.50","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"4696839a-435f-4055-97af-d18146b66b6f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4696839a-435f-4055-97af-d18146b66b6f","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":213899367,"seconds":1783654942},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.50:48220","port":48220}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","keyName":"e2e-revoketest-a-0","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4696839a-435f-4055-97af-d18146b66b6f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4696839a-435f-4055-97af-d18146b66b6f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44422","PortSpecifier":{"PortValue":44422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44422","PortSpecifier":{"PortValue":44422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":253646179},"http":{"id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"faaec07c-50c1-494c-b1ef-8a408d620f44","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"faaec07c-50c1-494c-b1ef-8a408d620f44","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":261871809},"http":{"id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"faaec07c-50c1-494c-b1ef-8a408d620f44","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"faaec07c-50c1-494c-b1ef-8a408d620f44","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.50","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctajlyYmQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.36~maas-default-gateway-openshift-default-56654dcf7-j9rbd.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.50","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":261871809,"seconds":1783654942},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.50:48220","port":48220}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"faaec07c-50c1-494c-b1ef-8a408d620f44","keyName":"e2e-revoketest-a-1","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44436","PortSpecifier":{"PortValue":44436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ab5628f7-6e24-42a3-b238-2d87631a2801","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44436","PortSpecifier":{"PortValue":44436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":294578267},"http":{"id":"ab5628f7-6e24-42a3-b238-2d87631a2801","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3188fc49-beea-436c-9604-9abc43475a92","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3188fc49-beea-436c-9604-9abc43475a92","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3188fc49-beea-436c-9604-9abc43475a92","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":302400299},"http":{"id":"3188fc49-beea-436c-9604-9abc43475a92","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3188fc49-beea-436c-9604-9abc43475a92","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.50","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctajlyYmQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.36~maas-default-gateway-openshift-default-56654dcf7-j9rbd.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.50","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"3188fc49-beea-436c-9604-9abc43475a92"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3188fc49-beea-436c-9604-9abc43475a92","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":302400299,"seconds":1783654942},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.50:48220","port":48220}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3188fc49-beea-436c-9604-9abc43475a92","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3188fc49-beea-436c-9604-9abc43475a92","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44446","PortSpecifier":{"PortValue":44446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44446","PortSpecifier":{"PortValue":44446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":336246376},"http":{"id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e653700a-8aef-4872-9530-679aa7c36136","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e653700a-8aef-4872-9530-679aa7c36136","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e653700a-8aef-4872-9530-679aa7c36136","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":344064089},"http":{"id":"e653700a-8aef-4872-9530-679aa7c36136","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e653700a-8aef-4872-9530-679aa7c36136","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.50","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctajlyYmQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.36~maas-default-gateway-openshift-default-56654dcf7-j9rbd.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.50","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"e653700a-8aef-4872-9530-679aa7c36136"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e653700a-8aef-4872-9530-679aa7c36136","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":344064089,"seconds":1783654942},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.50:48220","port":48220}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e653700a-8aef-4872-9530-679aa7c36136","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e653700a-8aef-4872-9530-679aa7c36136","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34242","PortSpecifier":{"PortValue":34242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34242","PortSpecifier":{"PortValue":34242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":563472161},"http":{"id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34258","PortSpecifier":{"PortValue":34258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34258","PortSpecifier":{"PortValue":34258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":594601768},"http":{"id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"faaec07c-50c1-494c-b1ef-8a408d620f44","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"faaec07c-50c1-494c-b1ef-8a408d620f44","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44cca80b-44be-427f-8c44-662ad9c62969","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34264","PortSpecifier":{"PortValue":34264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"44cca80b-44be-427f-8c44-662ad9c62969","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44cca80b-44be-427f-8c44-662ad9c62969","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34264","PortSpecifier":{"PortValue":34264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":625481307},"http":{"id":"44cca80b-44be-427f-8c44-662ad9c62969","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"44cca80b-44be-427f-8c44-662ad9c62969","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44cca80b-44be-427f-8c44-662ad9c62969","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44cca80b-44be-427f-8c44-662ad9c62969","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":633658141},"http":{"id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.50","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctajlyYmQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.36~maas-default-gateway-openshift-default-56654dcf7-j9rbd.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.50","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":633658141,"seconds":1783654949},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.50:48220","port":48220}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34280","PortSpecifier":{"PortValue":34280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34280","PortSpecifier":{"PortValue":34280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":673065106},"http":{"id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":681250790},"http":{"id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.50","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctajlyYmQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.36~maas-default-gateway-openshift-default-56654dcf7-j9rbd.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.50","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":681250790,"seconds":1783654949},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.50:48220","port":48220}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34290","PortSpecifier":{"PortValue":34290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12ea9659-a20c-49c3-86f9-883353d3fb73","method":"DELETE","path":"/maas-api/v1/api-keys/b30cbf53-12ff-4176-9e17-bdf5e6b3713f","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34290","PortSpecifier":{"PortValue":34290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":716565748},"http":{"id":"12ea9659-a20c-49c3-86f9-883353d3fb73","method":"DELETE","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/b30cbf53-12ff-4176-9e17-bdf5e6b3713f",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/b30cbf53-12ff-4176-9e17-bdf5e6b3713f",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34306","PortSpecifier":{"PortValue":34306}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","method":"DELETE","path":"/maas-api/v1/api-keys/fef5ab2d-2a53-49ec-bce8-eb7686e3e156","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34306","PortSpecifier":{"PortValue":34306}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":757497102},"http":{"id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","method":"DELETE","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/fef5ab2d-2a53-49ec-bce8-eb7686e3e156",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/fef5ab2d-2a53-49ec-bce8-eb7686e3e156",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:44:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"}
{"level":"info","ts":"2026-07-10T03:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4389775adb21d7184e8a0d6c5a81915c81d5faf262d86c8d946301e1bddba1ab"}
{"level":"info","ts":"2026-07-10T03:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/07a19985014a0dd0a51211350bfa7603a07c2f12a2abad927a26f0538970b4e9"}
{"level":"info","ts":"2026-07-10T03:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c"}
{"level":"info","ts":"2026-07-10T03:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"info","ts":"2026-07-10T03:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df82d9f85001d79a5f59cdca1f8364463e2422d110ef0daefd1b7ec028a38a77"}
{"level":"info","ts":"2026-07-10T03:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8357e27262dbde460a372c56a3cf8b2a4460727e9f4d289c676dc50678e7530c"}
{"level":"info","ts":"2026-07-10T03:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"}