{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"965750bc-9ffb-4a9d-b2ee-3b57979f6a43","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46444","PortSpecifier":{"PortValue":46444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46444","PortSpecifier":{"PortValue":46444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654909,"nanos":503463058},"http":{"id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2de4bf75-bda3-4a04-bad6-5199381e91d5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce77162e-df4a-4247-ba24-0b1885547431","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54718","PortSpecifier":{"PortValue":54718}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ce77162e-df4a-4247-ba24-0b1885547431","method":"POST","path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce77162e-df4a-4247-ba24-0b1885547431","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54718","PortSpecifier":{"PortValue":54718}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654909,"nanos":557561074},"http":{"id":"ce77162e-df4a-4247-ba24-0b1885547431","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-16d2rXdHDQBIJ5wJ3_fdeAn1G9W83JeeQLdIpTeVvUD9ynotfJdUeX02Kvxxn"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-16d2rXdHDQBIJ5wJ3_fdeAn1G9W83JeeQLdIpTeVvUD9ynotfJdUeX02Kvxxn\"}"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"531cef05-7085-4ff4-bc9e-1afcb8279111","keyName":"e2e-rate-a-5114d1","subscription":"e2e-rate-iso-a-5114d1","tenant":"e2e-shared-a-a7b338","userId":"531cef05-7085-4ff4-bc9e-1afcb8279111","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\",\"requestedSubscription\":\"e2e-rate-iso-a-5114d1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5114d1","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ce77162e-df4a-4247-ba24-0b1885547431","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5114d1"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce77162e-df4a-4247-ba24-0b1885547431","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"531cef05-7085-4ff4-bc9e-1afcb8279111","keyName":"e2e-rate-a-5114d1","selected_subscription":"e2e-rate-iso-a-5114d1","selected_subscription_key":"ai-tenant-e2e-shared-a-a7b338/e2e-rate-iso-a-5114d1@ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5114d1","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce77162e-df4a-4247-ba24-0b1885547431","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:41:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce77162e-df4a-4247-ba24-0b1885547431","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54724","PortSpecifier":{"PortValue":54724}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"721a09b2-45af-4863-8fb9-97c6c342588b","method":"POST","path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54724","PortSpecifier":{"PortValue":54724}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654910,"nanos":618613461},"http":{"id":"721a09b2-45af-4863-8fb9-97c6c342588b","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-16d2rXdHDQBIJ5wJ3_fdeAn1G9W83JeeQLdIpTeVvUD9ynotfJdUeX02Kvxxn"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-16d2rXdHDQBIJ5wJ3_fdeAn1G9W83JeeQLdIpTeVvUD9ynotfJdUeX02Kvxxn\"}"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"531cef05-7085-4ff4-bc9e-1afcb8279111","keyName":"e2e-rate-a-5114d1","subscription":"e2e-rate-iso-a-5114d1","tenant":"e2e-shared-a-a7b338","userId":"531cef05-7085-4ff4-bc9e-1afcb8279111","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\",\"requestedSubscription\":\"e2e-rate-iso-a-5114d1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5114d1","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5114d1"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"531cef05-7085-4ff4-bc9e-1afcb8279111","keyName":"e2e-rate-a-5114d1","selected_subscription":"e2e-rate-iso-a-5114d1","selected_subscription_key":"ai-tenant-e2e-shared-a-a7b338/e2e-rate-iso-a-5114d1@ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5114d1","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:41:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"721a09b2-45af-4863-8fb9-97c6c342588b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc55366a-2591-4983-9151-eceb0448974d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54738","PortSpecifier":{"PortValue":54738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dc55366a-2591-4983-9151-eceb0448974d","method":"POST","path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc55366a-2591-4983-9151-eceb0448974d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54738","PortSpecifier":{"PortValue":54738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654911,"nanos":657590187},"http":{"id":"dc55366a-2591-4983-9151-eceb0448974d","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-16d2rXdHDQBIJ5wJ3_fdeAn1G9W83JeeQLdIpTeVvUD9ynotfJdUeX02Kvxxn"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-16d2rXdHDQBIJ5wJ3_fdeAn1G9W83JeeQLdIpTeVvUD9ynotfJdUeX02Kvxxn\"}"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"531cef05-7085-4ff4-bc9e-1afcb8279111","keyName":"e2e-rate-a-5114d1","subscription":"e2e-rate-iso-a-5114d1","tenant":"e2e-shared-a-a7b338","userId":"531cef05-7085-4ff4-bc9e-1afcb8279111","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\",\"requestedSubscription\":\"e2e-rate-iso-a-5114d1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5114d1","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dc55366a-2591-4983-9151-eceb0448974d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5114d1"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc55366a-2591-4983-9151-eceb0448974d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"531cef05-7085-4ff4-bc9e-1afcb8279111","keyName":"e2e-rate-a-5114d1","selected_subscription":"e2e-rate-iso-a-5114d1","selected_subscription_key":"ai-tenant-e2e-shared-a-a7b338/e2e-rate-iso-a-5114d1@ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5114d1","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc55366a-2591-4983-9151-eceb0448974d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:41:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc55366a-2591-4983-9151-eceb0448974d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"298a721e-3f40-4671-9d23-0148686634a3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47170","PortSpecifier":{"PortValue":47170}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"298a721e-3f40-4671-9d23-0148686634a3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"298a721e-3f40-4671-9d23-0148686634a3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47170","PortSpecifier":{"PortValue":47170}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654926,"nanos":368651891},"http":{"id":"298a721e-3f40-4671-9d23-0148686634a3","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"298a721e-3f40-4671-9d23-0148686634a3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"298a721e-3f40-4671-9d23-0148686634a3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"298a721e-3f40-4671-9d23-0148686634a3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"298a721e-3f40-4671-9d23-0148686634a3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"298a721e-3f40-4671-9d23-0148686634a3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37508","PortSpecifier":{"PortValue":37508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37508","PortSpecifier":{"PortValue":37508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654926,"nanos":409578570},"http":{"id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7c2c4dc-6f8e-4089-abb6-6b2c2b00208d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"315ae6f7-481b-4702-a704-7ebd31345887","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47176","PortSpecifier":{"PortValue":47176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"315ae6f7-481b-4702-a704-7ebd31345887","method":"POST","path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"315ae6f7-481b-4702-a704-7ebd31345887","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47176","PortSpecifier":{"PortValue":47176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654926,"nanos":444977301},"http":{"id":"315ae6f7-481b-4702-a704-7ebd31345887","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-13tMXtkAvgsIqMzjX_Qrn63rxgmQMCQ9K3iTTvfTKFZrX8AFjCdLDL4bFZfiB"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-13tMXtkAvgsIqMzjX_Qrn63rxgmQMCQ9K3iTTvfTKFZrX8AFjCdLDL4bFZfiB\"}"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","keyName":"e2e-rate-a-c4e089","subscription":"e2e-rate-iso-a-c4e089","tenant":"e2e-shared-a-a7b338","userId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\",\"requestedSubscription\":\"e2e-rate-iso-a-c4e089\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c4e089","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"315ae6f7-481b-4702-a704-7ebd31345887","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c4e089"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"315ae6f7-481b-4702-a704-7ebd31345887","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","keyName":"e2e-rate-a-c4e089","selected_subscription":"e2e-rate-iso-a-c4e089","selected_subscription_key":"ai-tenant-e2e-shared-a-a7b338/e2e-rate-iso-a-c4e089@ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c4e089","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"315ae6f7-481b-4702-a704-7ebd31345887","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"315ae6f7-481b-4702-a704-7ebd31345887","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47178","PortSpecifier":{"PortValue":47178}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","method":"POST","path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47178","PortSpecifier":{"PortValue":47178}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654927,"nanos":491389854},"http":{"id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-13tMXtkAvgsIqMzjX_Qrn63rxgmQMCQ9K3iTTvfTKFZrX8AFjCdLDL4bFZfiB"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-13tMXtkAvgsIqMzjX_Qrn63rxgmQMCQ9K3iTTvfTKFZrX8AFjCdLDL4bFZfiB\"}"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","keyName":"e2e-rate-a-c4e089","subscription":"e2e-rate-iso-a-c4e089","tenant":"e2e-shared-a-a7b338","userId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\",\"requestedSubscription\":\"e2e-rate-iso-a-c4e089\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c4e089","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c4e089"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","keyName":"e2e-rate-a-c4e089","selected_subscription":"e2e-rate-iso-a-c4e089","selected_subscription_key":"ai-tenant-e2e-shared-a-a7b338/e2e-rate-iso-a-c4e089@ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c4e089","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc7d2d93-5ea5-4a23-be50-3d70f8dbd1ce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47188","PortSpecifier":{"PortValue":47188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","method":"POST","path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions","host":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47188","PortSpecifier":{"PortValue":47188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654928,"nanos":530216098},"http":{"id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","method":"POST","headers":{":authority":"e2e-shared-a-a7b338.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-13tMXtkAvgsIqMzjX_Qrn63rxgmQMCQ9K3iTTvfTKFZrX8AFjCdLDL4bFZfiB"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-13tMXtkAvgsIqMzjX_Qrn63rxgmQMCQ9K3iTTvfTKFZrX8AFjCdLDL4bFZfiB\"}"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","keyName":"e2e-rate-a-c4e089","subscription":"e2e-rate-iso-a-c4e089","tenant":"e2e-shared-a-a7b338","userId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\",\"requestedSubscription\":\"e2e-rate-iso-a-c4e089\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a7b338.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c4e089","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c4e089"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6eb554a8-dbe6-4cfd-9d01-335a25093bac","keyName":"e2e-rate-a-c4e089","selected_subscription":"e2e-rate-iso-a-c4e089","selected_subscription_key":"ai-tenant-e2e-shared-a-a7b338/e2e-rate-iso-a-c4e089@ai-tenant-e2e-shared-a-a7b338/rate-test-model-a7b338","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a7b338","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c4e089","namespace":"ai-tenant-e2e-shared-a-a7b338","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"36632253-c207-46c3-a3a6-04c2fa72d3c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37512","PortSpecifier":{"PortValue":37512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1f81b97b-68f6-4625-a32e-7be994e76944","method":"POST","path":"/ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732/v1/completions","host":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37512","PortSpecifier":{"PortValue":37512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654928,"nanos":563619897},"http":{"id":"1f81b97b-68f6-4625-a32e-7be994e76944","method":"POST","headers":{":authority":"e2e-shared-b-17c732.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-EmzyEi9neqzJZ4A1_MiXXSKfZquYChNMyVS0IvrH3ekJhiUfEv2jgVSjaS2K"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-EmzyEi9neqzJZ4A1_MiXXSKfZquYChNMyVS0IvrH3ekJhiUfEv2jgVSjaS2K\"}"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f51edf21-0bd1-408c-8ed2-9c53701f2b10","keyName":"e2e-rate-b-c4e089","subscription":"e2e-rate-iso-b-c4e089","tenant":"e2e-shared-b-17c732","userId":"f51edf21-0bd1-408c-8ed2-9c53701f2b10","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732\",\"requestedSubscription\":\"e2e-rate-iso-b-c4e089\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-17c732.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-17c732","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-c4e089","namespace":"ai-tenant-e2e-shared-b-17c732","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-c4e089"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f51edf21-0bd1-408c-8ed2-9c53701f2b10","keyName":"e2e-rate-b-c4e089","selected_subscription":"e2e-rate-iso-b-c4e089","selected_subscription_key":"ai-tenant-e2e-shared-b-17c732/e2e-rate-iso-b-c4e089@ai-tenant-e2e-shared-b-17c732/rate-test-model-17c732","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-17c732","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-c4e089","namespace":"ai-tenant-e2e-shared-b-17c732","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f81b97b-68f6-4625-a32e-7be994e76944","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44378","PortSpecifier":{"PortValue":44378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44378","PortSpecifier":{"PortValue":44378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":17617268},"http":{"id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","method":"POST","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1170dd9f-a580-4465-b7ab-dfb4eb531952","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44390","PortSpecifier":{"PortValue":44390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44390","PortSpecifier":{"PortValue":44390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":69944129},"http":{"id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","method":"POST","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b1b2d8a-c72d-460b-b26c-7ece9d349281","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44392","PortSpecifier":{"PortValue":44392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44392","PortSpecifier":{"PortValue":44392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":108933352},"http":{"id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","method":"POST","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b5941a8-e7fb-452f-9f3c-b1df32863eb4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44394","PortSpecifier":{"PortValue":44394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44394","PortSpecifier":{"PortValue":44394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":147057101},"http":{"id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","method":"POST","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0622f2db-4ca0-46dd-aab1-ecadddb24d55","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44408","PortSpecifier":{"PortValue":44408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44408","PortSpecifier":{"PortValue":44408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":183344210},"http":{"id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6318ab3-2b55-930e-b4e0-ba039c0712d3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4696839a-435f-4055-97af-d18146b66b6f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4696839a-435f-4055-97af-d18146b66b6f","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4696839a-435f-4055-97af-d18146b66b6f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":213899367},"http":{"id":"4696839a-435f-4055-97af-d18146b66b6f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4696839a-435f-4055-97af-d18146b66b6f","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.50","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctajlyYmQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.36~maas-default-gateway-openshift-default-56654dcf7-j9rbd.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.50","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"4696839a-435f-4055-97af-d18146b66b6f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4696839a-435f-4055-97af-d18146b66b6f","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":213899367,"seconds":1783654942},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.50:48220","port":48220}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4696839a-435f-4055-97af-d18146b66b6f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","keyName":"e2e-revoketest-a-0","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4696839a-435f-4055-97af-d18146b66b6f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4696839a-435f-4055-97af-d18146b66b6f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44422","PortSpecifier":{"PortValue":44422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44422","PortSpecifier":{"PortValue":44422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":253646179},"http":{"id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"faaec07c-50c1-494c-b1ef-8a408d620f44","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"faaec07c-50c1-494c-b1ef-8a408d620f44","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3ff986a-a5df-4072-842b-0565bc7eb20d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":261871809},"http":{"id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"faaec07c-50c1-494c-b1ef-8a408d620f44","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"faaec07c-50c1-494c-b1ef-8a408d620f44","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.50","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctajlyYmQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.36~maas-default-gateway-openshift-default-56654dcf7-j9rbd.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.50","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":261871809,"seconds":1783654942},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.50:48220","port":48220}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"faaec07c-50c1-494c-b1ef-8a408d620f44","keyName":"e2e-revoketest-a-1","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb53e5c6-0917-4cb2-8872-aea49618d5dd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44436","PortSpecifier":{"PortValue":44436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ab5628f7-6e24-42a3-b238-2d87631a2801","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44436","PortSpecifier":{"PortValue":44436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":294578267},"http":{"id":"ab5628f7-6e24-42a3-b238-2d87631a2801","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab5628f7-6e24-42a3-b238-2d87631a2801","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3188fc49-beea-436c-9604-9abc43475a92","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3188fc49-beea-436c-9604-9abc43475a92","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3188fc49-beea-436c-9604-9abc43475a92","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":302400299},"http":{"id":"3188fc49-beea-436c-9604-9abc43475a92","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3188fc49-beea-436c-9604-9abc43475a92","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.50","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctajlyYmQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.36~maas-default-gateway-openshift-default-56654dcf7-j9rbd.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.50","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"3188fc49-beea-436c-9604-9abc43475a92"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3188fc49-beea-436c-9604-9abc43475a92","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":302400299,"seconds":1783654942},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.50:48220","port":48220}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3188fc49-beea-436c-9604-9abc43475a92","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3188fc49-beea-436c-9604-9abc43475a92","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3188fc49-beea-436c-9604-9abc43475a92","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44446","PortSpecifier":{"PortValue":44446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:44446","PortSpecifier":{"PortValue":44446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":336246376},"http":{"id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"676d2128-c2cd-4a7c-a1ec-5a5b3be15002","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e653700a-8aef-4872-9530-679aa7c36136","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e653700a-8aef-4872-9530-679aa7c36136","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e653700a-8aef-4872-9530-679aa7c36136","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654942,"nanos":344064089},"http":{"id":"e653700a-8aef-4872-9530-679aa7c36136","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e653700a-8aef-4872-9530-679aa7c36136","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.50","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctajlyYmQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.36~maas-default-gateway-openshift-default-56654dcf7-j9rbd.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.50","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"e653700a-8aef-4872-9530-679aa7c36136"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e653700a-8aef-4872-9530-679aa7c36136","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":344064089,"seconds":1783654942},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.50:48220","port":48220}}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e653700a-8aef-4872-9530-679aa7c36136","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e653700a-8aef-4872-9530-679aa7c36136","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e653700a-8aef-4872-9530-679aa7c36136","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b557504ebc284d8669e5cdf1fac2100c5e5547187061fec642ee813399f02ecb"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f9c66c881d5a460b693e6bf11283c2a371cb8863629d93fb7049fb6c64c42a55"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ccdf1a47d1ae444eecea13fd90d6e5735d7b0c608c93bc6c5539289aa94e39a6"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0c67a57de8e523c7a23f0f1082c6a53aa1bee6707270dfcbebcc84b3a2d5db92"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f00982f11c93ce29cfd322b0e58708fd68e42e65e0930a1d1a796674f3df58fe"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cb55f001789ebed8121071ec009a128173c0c366f2b38615ee00eb4b6fe5fb97"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e0b9398753921f13a784872185522a1d3663df35cddb7437d14f3ce6e50daa25"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d8830a875be7113e5473321d1a8288b4c2dc54751294bc19663b70d8189dbeca"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b0e081a1f49050463fd7d2a21018e005d585dedbe06875a1ee8e95e233e51113"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4e1eb5d903889be72d8163169a3f6a6c0cafa1df97bf7ff5db63affcc1943ead"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/99c723e804090d114e7aa0745282b05982da5296f769563698c84d5246027f8d"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b639cc559a9dca914d8df6167bb3d6d34a1843dbc8179f9279dd1353e0acc543"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0527436acf6d582449da895b5691d6505e6d9f7e10c9c8e631c7912cfb458d52"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7fcbbc9bfa7bbca3b29c28e91a243b8db622197352ab903146cfec2d632d95d9"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/94ee379165d90ce90d3335c548b2a0a7aa8536a84c1dd1843b21b162d8e4cdde"}
{"level":"info","ts":"2026-07-10T03:42:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/77bc64dd70038ee7c6e99248b8c4fdc4df9b70f207f4261e446956321fe8e90c"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34242","PortSpecifier":{"PortValue":34242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34242","PortSpecifier":{"PortValue":34242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":563472161},"http":{"id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-161MQu8lTCIcfBfXv_S3O9SUP2lb4Q6vhzLquNda2s2jUn97Dd5i6ILVOmvFn\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"dfb7574a-aea5-4c69-b4f3-680dee7690f5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e41f8f5-b4e7-4565-ac82-c52f67fb0713","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34258","PortSpecifier":{"PortValue":34258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34258","PortSpecifier":{"PortValue":34258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":594601768},"http":{"id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-nwyn2LQ9xDBpOJgJ_SePQzMND3PtddMcxED3PivlgDrhRu6aplZz5GbC23Zh\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"faaec07c-50c1-494c-b1ef-8a408d620f44","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"faaec07c-50c1-494c-b1ef-8a408d620f44","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25f0999f-bbe7-4f34-9a2a-e1db70b7f87b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44cca80b-44be-427f-8c44-662ad9c62969","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34264","PortSpecifier":{"PortValue":34264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"44cca80b-44be-427f-8c44-662ad9c62969","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44cca80b-44be-427f-8c44-662ad9c62969","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34264","PortSpecifier":{"PortValue":34264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":625481307},"http":{"id":"44cca80b-44be-427f-8c44-662ad9c62969","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"44cca80b-44be-427f-8c44-662ad9c62969","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44cca80b-44be-427f-8c44-662ad9c62969","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44cca80b-44be-427f-8c44-662ad9c62969","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44cca80b-44be-427f-8c44-662ad9c62969","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":633658141},"http":{"id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-cqa7qsnxf7LXQT8j_HUABcG2ot1ZuWzbg4R3uXrXa1ka070vgtkPaiU5cxjw","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.50","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctajlyYmQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.36~maas-default-gateway-openshift-default-56654dcf7-j9rbd.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.50","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":633658141,"seconds":1783654949},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.50:48220","port":48220}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b30cbf53-12ff-4176-9e17-bdf5e6b3713f","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17b3d9e6-3900-4f4a-ba11-102dccb9cb49","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34280","PortSpecifier":{"PortValue":34280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34280","PortSpecifier":{"PortValue":34280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":673065106},"http":{"id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","method":"GET","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b124fa28-b6a4-47b8-ba97-5103a811b6d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:48220","PortSpecifier":{"PortValue":48220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":681250790},"http":{"id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1HRc5tVoC6r6rB8p0_YHM0gt1AnILRCB6GDME0Hw71hQERXGPUBHUEnLlyEyS","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.50","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctajlyYmQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.36~maas-default-gateway-openshift-default-56654dcf7-j9rbd.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.50","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":681250790,"seconds":1783654949},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.50:48220","port":48220}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fef5ab2d-2a53-49ec-bce8-eb7686e3e156","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f532f2c2-63c5-43dc-9b64-75c4bd96b1d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34290","PortSpecifier":{"PortValue":34290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12ea9659-a20c-49c3-86f9-883353d3fb73","method":"DELETE","path":"/maas-api/v1/api-keys/b30cbf53-12ff-4176-9e17-bdf5e6b3713f","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34290","PortSpecifier":{"PortValue":34290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":716565748},"http":{"id":"12ea9659-a20c-49c3-86f9-883353d3fb73","method":"DELETE","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/b30cbf53-12ff-4176-9e17-bdf5e6b3713f",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/b30cbf53-12ff-4176-9e17-bdf5e6b3713f",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12ea9659-a20c-49c3-86f9-883353d3fb73","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34306","PortSpecifier":{"PortValue":34306}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","method":"DELETE","path":"/maas-api/v1/api-keys/fef5ab2d-2a53-49ec-bce8-eb7686e3e156","host":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34306","PortSpecifier":{"PortValue":34306}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783654949,"nanos":757497102},"http":{"id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","method":"DELETE","headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/fef5ab2d-2a53-49ec-bce8-eb7686e3e156",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"]}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87e5a8a78694"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=71abc5e9-d275-42c0-b2da-9d25ff758d91"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c565849e-28a4-4577-8a24-b6020ac65e8d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1cfcfee8-131e-4705-931b-87e5a8a78694.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/fef5ab2d-2a53-49ec-bce8-eb7686e3e156",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T03:42:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9e4253c-bf5f-4d4d-9ec9-1638624c4f03","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T03:44:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d52c8d19fabd814279620a627229f435bfe4d645badb459bd9cfbe1b9ec404c6"}
{"level":"info","ts":"2026-07-10T03:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4389775adb21d7184e8a0d6c5a81915c81d5faf262d86c8d946301e1bddba1ab"}
{"level":"info","ts":"2026-07-10T03:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/07a19985014a0dd0a51211350bfa7603a07c2f12a2abad927a26f0538970b4e9"}
{"level":"info","ts":"2026-07-10T03:44:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a840288546208e405a1dbc762c41b0717b546171a9754913e9ef8208d498359c"}
{"level":"info","ts":"2026-07-10T03:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2c92ca48c6bf0880702be87f07046c24214b50694a978c25ae87ad0294f28190"}
{"level":"info","ts":"2026-07-10T03:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df82d9f85001d79a5f59cdca1f8364463e2422d110ef0daefd1b7ec028a38a77"}
{"level":"info","ts":"2026-07-10T03:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8357e27262dbde460a372c56a3cf8b2a4460727e9f4d289c676dc50678e7530c"}
{"level":"info","ts":"2026-07-10T03:45:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d55327ea6ccebe21f32564deb25eeb10872efe8bb7dbb49c0b9fd4f974c0884f"}