{"level":"info","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e99bba13-7354-4fd5-852f-9a10e0302b21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e99bba13-7354-4fd5-852f-9a10e0302b21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:56720","PortSpecifier":{"PortValue":56720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-0a0df7.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:56720","PortSpecifier":{"PortValue":56720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901262,"nanos":792951889},"http":{"id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","method":"POST","headers":{":authority":"e2e-shared-b-0a0df7.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4cf9ca8a-7b46-42e6-9f3f-1e4283b66cb5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=afacb5ce-bdb2-46b9-b5e4-ef98c46827d2"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/88cd366608a3"]}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/88cd366608a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=afacb5ce-bdb2-46b9-b5e4-ef98c46827d2"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4cf9ca8a-7b46-42e6-9f3f-1e4283b66cb5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"f6801e97a40f94a73a4fe004c402b2107e51e04376946a618b097712157e181b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.56:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-0a0df7.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-0a0df7/rate-test-model-0a0df7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-0a0df7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c0eb2c8b-03dc-445b-b1c9-7ed41c30ecd5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:45984","PortSpecifier":{"PortValue":45984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","method":"POST","path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions","host":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:45984","PortSpecifier":{"PortValue":45984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901262,"nanos":829493727},"http":{"id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","method":"POST","headers":{":authority":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA"}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA\"}"}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","subscription":"e2e-rate-iso-a-686574","tenant":"e2e-shared-a-934481","userId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\",\"requestedSubscription\":\"e2e-rate-iso-a-686574\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-934481/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-686574"}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","selected_subscription":"e2e-rate-iso-a-686574","selected_subscription_key":"ai-tenant-e2e-shared-a-934481/e2e-rate-iso-a-686574@ai-tenant-e2e-shared-a-934481/rate-test-model-934481","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"acf5cc71-ac19-42dc-a731-b0487e6819dc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:45990","PortSpecifier":{"PortValue":45990}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","method":"POST","path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions","host":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:45990","PortSpecifier":{"PortValue":45990}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901263,"nanos":867656744},"http":{"id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","method":"POST","headers":{":authority":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA"}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA\"}"}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","subscription":"e2e-rate-iso-a-686574","tenant":"e2e-shared-a-934481","userId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\",\"requestedSubscription\":\"e2e-rate-iso-a-686574\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"}}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-934481/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-686574"}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","selected_subscription":"e2e-rate-iso-a-686574","selected_subscription_key":"ai-tenant-e2e-shared-a-934481/e2e-rate-iso-a-686574@ai-tenant-e2e-shared-a-934481/rate-test-model-934481","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e59b9b8-5e0e-49a2-aeec-4a85d33f9fe0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:45996","PortSpecifier":{"PortValue":45996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6233187e-4114-4a62-9b92-f8d8e40786bd","method":"POST","path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions","host":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:45996","PortSpecifier":{"PortValue":45996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901264,"nanos":910629019},"http":{"id":"6233187e-4114-4a62-9b92-f8d8e40786bd","method":"POST","headers":{":authority":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA"}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA\"}"}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","subscription":"e2e-rate-iso-a-686574","tenant":"e2e-shared-a-934481","userId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\",\"requestedSubscription\":\"e2e-rate-iso-a-686574\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"}}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-934481/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-686574"}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","selected_subscription":"e2e-rate-iso-a-686574","selected_subscription_key":"ai-tenant-e2e-shared-a-934481/e2e-rate-iso-a-686574@ai-tenant-e2e-shared-a-934481/rate-test-model-934481","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6233187e-4114-4a62-9b92-f8d8e40786bd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59266","PortSpecifier":{"PortValue":59266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","method":"POST","path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions","host":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59266","PortSpecifier":{"PortValue":59266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901265,"nanos":954815733},"http":{"id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","method":"POST","headers":{":authority":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA"}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA\"}"}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","subscription":"e2e-rate-iso-a-686574","tenant":"e2e-shared-a-934481","userId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\",\"requestedSubscription\":\"e2e-rate-iso-a-686574\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"}}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-934481/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-686574"}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","selected_subscription":"e2e-rate-iso-a-686574","selected_subscription_key":"ai-tenant-e2e-shared-a-934481/e2e-rate-iso-a-686574@ai-tenant-e2e-shared-a-934481/rate-test-model-934481","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1f9feb8-cb96-483c-873a-debb2ef9d99e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59278","PortSpecifier":{"PortValue":59278}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","method":"POST","path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions","host":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:54:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59278","PortSpecifier":{"PortValue":59278}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901266,"nanos":995979116},"http":{"id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","method":"POST","headers":{":authority":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA"}
{"level":"debug","ts":"2026-07-24T13:54:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA\"}"}
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","subscription":"e2e-rate-iso-a-686574","tenant":"e2e-shared-a-934481","userId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\",\"requestedSubscription\":\"e2e-rate-iso-a-686574\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"}}
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-934481/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-686574"}
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","selected_subscription":"e2e-rate-iso-a-686574","selected_subscription_key":"ai-tenant-e2e-shared-a-934481/e2e-rate-iso-a-686574@ai-tenant-e2e-shared-a-934481/rate-test-model-934481","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f3e8d6d4-9fbd-40a6-bc50-f8c383d76019","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59294","PortSpecifier":{"PortValue":59294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5df94675-5897-4258-b1cb-29a2a9da7c94","method":"POST","path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions","host":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59294","PortSpecifier":{"PortValue":59294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901268,"nanos":31340063},"http":{"id":"5df94675-5897-4258-b1cb-29a2a9da7c94","method":"POST","headers":{":authority":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA"}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA\"}"}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","subscription":"e2e-rate-iso-a-686574","tenant":"e2e-shared-a-934481","userId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\",\"requestedSubscription\":\"e2e-rate-iso-a-686574\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"}}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-934481/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-686574"}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","selected_subscription":"e2e-rate-iso-a-686574","selected_subscription_key":"ai-tenant-e2e-shared-a-934481/e2e-rate-iso-a-686574@ai-tenant-e2e-shared-a-934481/rate-test-model-934481","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5df94675-5897-4258-b1cb-29a2a9da7c94","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5680057a-6b45-404d-a672-1192132a6279","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59300","PortSpecifier":{"PortValue":59300}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5680057a-6b45-404d-a672-1192132a6279","method":"POST","path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions","host":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5680057a-6b45-404d-a672-1192132a6279","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59300","PortSpecifier":{"PortValue":59300}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901269,"nanos":67624069},"http":{"id":"5680057a-6b45-404d-a672-1192132a6279","method":"POST","headers":{":authority":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5680057a-6b45-404d-a672-1192132a6279","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA"}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5680057a-6b45-404d-a672-1192132a6279","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA\"}"}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5680057a-6b45-404d-a672-1192132a6279","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","subscription":"e2e-rate-iso-a-686574","tenant":"e2e-shared-a-934481","userId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5680057a-6b45-404d-a672-1192132a6279","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\",\"requestedSubscription\":\"e2e-rate-iso-a-686574\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5680057a-6b45-404d-a672-1192132a6279","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"}}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5680057a-6b45-404d-a672-1192132a6279","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5680057a-6b45-404d-a672-1192132a6279","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5680057a-6b45-404d-a672-1192132a6279","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5680057a-6b45-404d-a672-1192132a6279","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5680057a-6b45-404d-a672-1192132a6279","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-934481/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5680057a-6b45-404d-a672-1192132a6279","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5680057a-6b45-404d-a672-1192132a6279","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5680057a-6b45-404d-a672-1192132a6279","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-686574"}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5680057a-6b45-404d-a672-1192132a6279","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","selected_subscription":"e2e-rate-iso-a-686574","selected_subscription_key":"ai-tenant-e2e-shared-a-934481/e2e-rate-iso-a-686574@ai-tenant-e2e-shared-a-934481/rate-test-model-934481","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5680057a-6b45-404d-a672-1192132a6279","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5680057a-6b45-404d-a672-1192132a6279","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59310","PortSpecifier":{"PortValue":59310}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","method":"POST","path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions","host":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59310","PortSpecifier":{"PortValue":59310}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901270,"nanos":109907803},"http":{"id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","method":"POST","headers":{":authority":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA"}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA\"}"}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","subscription":"e2e-rate-iso-a-686574","tenant":"e2e-shared-a-934481","userId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\",\"requestedSubscription\":\"e2e-rate-iso-a-686574\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"}}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-934481/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-686574"}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","selected_subscription":"e2e-rate-iso-a-686574","selected_subscription_key":"ai-tenant-e2e-shared-a-934481/e2e-rate-iso-a-686574@ai-tenant-e2e-shared-a-934481/rate-test-model-934481","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0e154af-a9c8-424b-aae3-7e8f88789f3c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"49222c0a-3041-4850-9fae-dd703a416cca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59326","PortSpecifier":{"PortValue":59326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"49222c0a-3041-4850-9fae-dd703a416cca","method":"POST","path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions","host":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"49222c0a-3041-4850-9fae-dd703a416cca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59326","PortSpecifier":{"PortValue":59326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901271,"nanos":147721075},"http":{"id":"49222c0a-3041-4850-9fae-dd703a416cca","method":"POST","headers":{":authority":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA"}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA\"}"}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","subscription":"e2e-rate-iso-a-686574","tenant":"e2e-shared-a-934481","userId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\",\"requestedSubscription\":\"e2e-rate-iso-a-686574\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"}}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"49222c0a-3041-4850-9fae-dd703a416cca","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-934481/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-686574"}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49222c0a-3041-4850-9fae-dd703a416cca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","selected_subscription":"e2e-rate-iso-a-686574","selected_subscription_key":"ai-tenant-e2e-shared-a-934481/e2e-rate-iso-a-686574@ai-tenant-e2e-shared-a-934481/rate-test-model-934481","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"49222c0a-3041-4850-9fae-dd703a416cca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"49222c0a-3041-4850-9fae-dd703a416cca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59330","PortSpecifier":{"PortValue":59330}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","method":"POST","path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions","host":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59330","PortSpecifier":{"PortValue":59330}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901272,"nanos":190612722},"http":{"id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","method":"POST","headers":{":authority":"e2e-shared-a-934481.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-934481/rate-test-model-934481/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Iim8ZZh96k3AMPaP_YXyDxh0IPvIELaJqnlXjdxGwQD0xl7hUGuIQveUuwOA\"}"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","subscription":"e2e-rate-iso-a-686574","tenant":"e2e-shared-a-934481","userId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\",\"requestedSubscription\":\"e2e-rate-iso-a-686574\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-934481.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-934481/rate-test-model-934481\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-934481/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-686574"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e91c7230-67b6-46df-abf2-54d6a3bb977b","keyName":"e2e-rate-a-686574","selected_subscription":"e2e-rate-iso-a-686574","selected_subscription_key":"ai-tenant-e2e-shared-a-934481/e2e-rate-iso-a-686574@ai-tenant-e2e-shared-a-934481/rate-test-model-934481","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-934481","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-686574","namespace":"ai-tenant-e2e-shared-a-934481","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-934481/rate-test-model-934481"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dec5724f-3152-4d9d-aca3-91fe9389df8c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57752","PortSpecifier":{"PortValue":57752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","method":"POST","path":"/ai-tenant-e2e-shared-b-0a0df7/rate-test-model-0a0df7/v1/completions","host":"e2e-shared-b-0a0df7.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57752","PortSpecifier":{"PortValue":57752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901272,"nanos":232293572},"http":{"id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","method":"POST","headers":{":authority":"e2e-shared-b-0a0df7.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-0a0df7/rate-test-model-0a0df7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-mJ1BIdZLheB529u6_cjcUwnLKFamT6KKJ5rbwEhKYUCG7PGzDRx8dKdJXRae"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-0a0df7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-mJ1BIdZLheB529u6_cjcUwnLKFamT6KKJ5rbwEhKYUCG7PGzDRx8dKdJXRae\"}"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-0a0df7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a038066b-6434-4031-b963-0337fea074b6","keyName":"e2e-rate-b-686574","subscription":"e2e-rate-iso-b-686574","tenant":"e2e-shared-b-0a0df7","userId":"a038066b-6434-4031-b963-0337fea074b6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-0a0df7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-0a0df7/rate-test-model-0a0df7\",\"requestedSubscription\":\"e2e-rate-iso-b-686574\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-0a0df7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0a0df7","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-686574","namespace":"ai-tenant-e2e-shared-b-0a0df7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-0a0df7/rate-test-model-0a0df7"}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-0a0df7/rate-test-model-0a0df7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-0a0df7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-686574"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a038066b-6434-4031-b963-0337fea074b6","keyName":"e2e-rate-b-686574","selected_subscription":"e2e-rate-iso-b-686574","selected_subscription_key":"ai-tenant-e2e-shared-b-0a0df7/e2e-rate-iso-b-686574@ai-tenant-e2e-shared-b-0a0df7/rate-test-model-0a0df7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0a0df7","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-686574","namespace":"ai-tenant-e2e-shared-b-0a0df7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-0a0df7/rate-test-model-0a0df7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:54:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a92ffc6-de2a-4b7f-be54-6e460a03cddd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:54:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ab87c4765091e39c6b9d5ceee5c556c616f24c463172a431ec1dd5f6db8d25eb"}
{"level":"info","ts":"2026-07-24T13:54:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f7f7068f4004b17539559bc410a7eecf6d760a72e9ac4778d08d84e1bd13d73e"}
{"level":"info","ts":"2026-07-24T13:54:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/554a69e5198754ca924c069d287f36207dc234ef98e439bdfd1d0a05681752b5"}
{"level":"info","ts":"2026-07-24T13:54:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8bd8551f5b36b8c1768f32c60f0d5b33d8676e9ce8a7b9c35719d4ad1169bba8"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/21d1eccccaf41547364ee4a1fdfc0e21da6b0b9961a70e45cc5b53cebd913e4f"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/006f01f5669d2bd99cd5ae9cb291fe310061f58f746c1a7cb29973f85fb82bdc"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0ea4ff645cb438d727bf413a8e20c4c50bec50377a10123c7d12d86db666605f"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aa48a4580155df5d63722db46441dae7f96fc79f79eee16d00e34c9ecc7a5ee9"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c35cb852c57f524fc9365c002618dc63cd34208a4910333f6cca875512d577a3"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/13324af5e4607cab83482c42b3a71589db68963c0f18d00850c3fd1d134cb6c0"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/55d8a839ae734a027fab7dc5579e8b0ed63bf42a60e791d77603787f21e2e210"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f6801e97a40f94a73a4fe004c402b2107e51e04376946a618b097712157e181b"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/78d5275ff47ba7f721826d94c4610127fed75e1814b50ba737f6eea99b2a20fd"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/47af07ea3d5edd62375e414d91f22e3707cf40c88f9cee6c4f6c68803f98ea0a"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d1f407b350db27979ab201068896f0c66e47b7a7f99708b24d00eb7edeec6ee7"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5e3c644e1f8ce96d2d7e874e68a1fd08f219e736f49f852ea965fef00d7b5e14"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8e636c725e63af66e1f936f6d4d78dbed12cd716dc31483d87600a4ee2c7509c"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ce83e3885aa1c3725e54cc532f8a99755879c8ab6d57258a9e9d75a75d75be14"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b5c3b719d012ae0bb004b54a3a09bac424767a9ffd9201a6b6110daacdab49e0"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a13daffe98676e50994930dd57a7cefd577a74daf7a1b9beabbdc35fc6ef404f"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b9bdcb8bd94ed29b3dbcaf39c0945f16590b4e005ae49840ff48ca40b11fc87"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3be6d50e17dc1d650f8c07e4c7037f97b9d33e6108c48caf6753eb8a8429a1b6"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b54f3952364a818f0dd12d65226f11ee5b49f7c44f72e285451f8375613d87a"}
{"level":"info","ts":"2026-07-24T13:54:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2e527be33b314462473577283a443f8ee06019abbb29b1dac5bb654910b96eea"}
{"level":"info","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59220","PortSpecifier":{"PortValue":59220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8a7c5746-f441-48d3-8004-284bfb47d621","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59220","PortSpecifier":{"PortValue":59220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901339,"nanos":670010273},"http":{"id":"8a7c5746-f441-48d3-8004-284bfb47d621","method":"POST","headers":{":authority":"maas.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4cf9ca8a-7b46-42e6-9f3f-1e4283b66cb5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=afacb5ce-bdb2-46b9-b5e4-ef98c46827d2"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/88cd366608a3"]}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/88cd366608a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=afacb5ce-bdb2-46b9-b5e4-ef98c46827d2"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4cf9ca8a-7b46-42e6-9f3f-1e4283b66cb5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8a7c5746-f441-48d3-8004-284bfb47d621","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59236","PortSpecifier":{"PortValue":59236}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59236","PortSpecifier":{"PortValue":59236}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901339,"nanos":720830082},"http":{"id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","method":"POST","headers":{":authority":"maas.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1OYaFEnXOrlnpb8Dq_HVVCyjaQydRnrnuCP7PZ7QartVLzcmDoNQk5WS7TvWZ"}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1OYaFEnXOrlnpb8Dq_HVVCyjaQydRnrnuCP7PZ7QartVLzcmDoNQk5WS7TvWZ\"}"}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f1df883d-d120-4a80-9dd5-689906f0ee17","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"f1df883d-d120-4a80-9dd5-689906f0ee17","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f1df883d-d120-4a80-9dd5-689906f0ee17","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:55:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e45c48ff-32be-42c0-8c9a-ae93ee784195","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba"}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba"}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f"}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba"}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f"}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f"}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f"}
{"level":"info","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c"}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c"}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aa17b7528f7ccb7970d4371622daa0502c9365a2b53a5383a6ca7e629b09f8a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aa17b7528f7ccb7970d4371622daa0502c9365a2b53a5383a6ca7e629b09f8a"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aa17b7528f7ccb7970d4371622daa0502c9365a2b53a5383a6ca7e629b09f8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"af90c36a4f617782812aeae0a7568c714bc9a0e8b477b776bfb3244768352cd6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"af90c36a4f617782812aeae0a7568c714bc9a0e8b477b776bfb3244768352cd6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7aa17b7528f7ccb7970d4371622daa0502c9365a2b53a5383a6ca7e629b09f8a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7aa17b7528f7ccb7970d4371622daa0502c9365a2b53a5383a6ca7e629b09f8a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7aa17b7528f7ccb7970d4371622daa0502c9365a2b53a5383a6ca7e629b09f8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/af90c36a4f617782812aeae0a7568c714bc9a0e8b477b776bfb3244768352cd6"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"af90c36a4f617782812aeae0a7568c714bc9a0e8b477b776bfb3244768352cd6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["af90c36a4f617782812aeae0a7568c714bc9a0e8b477b776bfb3244768352cd6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7aa17b7528f7ccb7970d4371622daa0502c9365a2b53a5383a6ca7e629b09f8a"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"af90c36a4f617782812aeae0a7568c714bc9a0e8b477b776bfb3244768352cd6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7aa17b7528f7ccb7970d4371622daa0502c9365a2b53a5383a6ca7e629b09f8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"af90c36a4f617782812aeae0a7568c714bc9a0e8b477b776bfb3244768352cd6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c"}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/af90c36a4f617782812aeae0a7568c714bc9a0e8b477b776bfb3244768352cd6"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c"}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f"}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"962d2b475e40e87c54da1625b9e71da05ace2395e200188ffc17bb8b7ffca32f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"962d2b475e40e87c54da1625b9e71da05ace2395e200188ffc17bb8b7ffca32f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/962d2b475e40e87c54da1625b9e71da05ace2395e200188ffc17bb8b7ffca32f"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"962d2b475e40e87c54da1625b9e71da05ace2395e200188ffc17bb8b7ffca32f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["962d2b475e40e87c54da1625b9e71da05ace2395e200188ffc17bb8b7ffca32f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"962d2b475e40e87c54da1625b9e71da05ace2395e200188ffc17bb8b7ffca32f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"962d2b475e40e87c54da1625b9e71da05ace2395e200188ffc17bb8b7ffca32f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867"}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/962d2b475e40e87c54da1625b9e71da05ace2395e200188ffc17bb8b7ffca32f"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867"}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b1398387be95dc6950f4efda670c5e853e252fc5a29761ad498b4cf4e46f93a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1398387be95dc6950f4efda670c5e853e252fc5a29761ad498b4cf4e46f93a4"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b1398387be95dc6950f4efda670c5e853e252fc5a29761ad498b4cf4e46f93a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b1398387be95dc6950f4efda670c5e853e252fc5a29761ad498b4cf4e46f93a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1398387be95dc6950f4efda670c5e853e252fc5a29761ad498b4cf4e46f93a4"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b1398387be95dc6950f4efda670c5e853e252fc5a29761ad498b4cf4e46f93a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b1398387be95dc6950f4efda670c5e853e252fc5a29761ad498b4cf4e46f93a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b1398387be95dc6950f4efda670c5e853e252fc5a29761ad498b4cf4e46f93a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b1398387be95dc6950f4efda670c5e853e252fc5a29761ad498b4cf4e46f93a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b1398387be95dc6950f4efda670c5e853e252fc5a29761ad498b4cf4e46f93a4"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97"}
{"level":"info","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3"}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97"}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3"}
{"level":"error","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"}
{"level":"error","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T13:56:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T13:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"}
{"level":"info","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53782","PortSpecifier":{"PortValue":53782}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"214dffb4-bce1-4676-8b64-9a186d582ce6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-e7750f.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53782","PortSpecifier":{"PortValue":53782}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901395,"nanos":123970606},"http":{"id":"214dffb4-bce1-4676-8b64-9a186d582ce6","method":"POST","headers":{":authority":"e2e-ipp-a-e7750f.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4cf9ca8a-7b46-42e6-9f3f-1e4283b66cb5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=afacb5ce-bdb2-46b9-b5e4-ef98c46827d2"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/88cd366608a3"]}}
{"level":"debug","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/88cd366608a3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=afacb5ce-bdb2-46b9-b5e4-ef98c46827d2"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4cf9ca8a-7b46-42e6-9f3f-1e4283b66cb5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-e7750f.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-e7750f/ipp-route-e7750f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-e7750f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:56:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"214dffb4-bce1-4676-8b64-9a186d582ce6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57888","PortSpecifier":{"PortValue":57888}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","method":"POST","path":"/ai-tenant-e2e-ipp-a-e7750f/ipp-route-e7750f/v1/chat/completions","host":"e2e-ipp-a-e7750f.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57888","PortSpecifier":{"PortValue":57888}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784901397,"nanos":188068414},"http":{"id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","method":"POST","headers":{":authority":"e2e-ipp-a-e7750f.apps.a6ada5a2-0b34-4699-8fdb-88cd366608a3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-e7750f/ipp-route-e7750f/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SKPoVIQfspsv1g73_7b40GoZefZPMtX2F25LCYWITJUvR8aQikxGhZ3Oz3as"}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-e7750f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SKPoVIQfspsv1g73_7b40GoZefZPMtX2F25LCYWITJUvR8aQikxGhZ3Oz3as\"}"}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-e7750f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"01023458-da96-43bc-a4ef-640ba3edfc3a","keyName":"e2e-ipp-e7750f","subscription":"ipp-route-e7750f-sub","tenant":"e2e-ipp-a-e7750f","userId":"01023458-da96-43bc-a4ef-640ba3edfc3a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-e7750f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-e7750f/ipp-route-e7750f\",\"requestedSubscription\":\"ipp-route-e7750f-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-e7750f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"ipp-route-e7750f","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-e7750f-sub","namespace":"ai-tenant-e2e-ipp-a-e7750f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-e7750f/ipp-route-e7750f"}}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-e7750f/ipp-route-e7750f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-e7750f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-e7750f-sub"}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"01023458-da96-43bc-a4ef-640ba3edfc3a","keyName":"e2e-ipp-e7750f","selected_subscription":"ipp-route-e7750f-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-e7750f/ipp-route-e7750f-sub@ai-tenant-e2e-ipp-a-e7750f/ipp-route-e7750f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"ipp-route-e7750f","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-e7750f-sub","namespace":"ai-tenant-e2e-ipp-a-e7750f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-e7750f/ipp-route-e7750f"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T13:56:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e1c7a22-2fc5-922a-b5c4-be4a55ab7a1d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T13:57:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/af90c36a4f617782812aeae0a7568c714bc9a0e8b477b776bfb3244768352cd6"}
{"level":"info","ts":"2026-07-24T13:57:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c0ff556540de95a902b88b26405c85bc506a5331cf78fcf12ca352c89c88ccfc"}
{"level":"info","ts":"2026-07-24T13:57:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c5b4c9a3de9f335469e35944868c5f453e4529d3a29633abcb77c5a6157fadba"}
{"level":"info","ts":"2026-07-24T13:57:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/962d2b475e40e87c54da1625b9e71da05ace2395e200188ffc17bb8b7ffca32f"}
{"level":"info","ts":"2026-07-24T13:57:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dbac50bbc8e03dc8ce3c5201711995ccb9246c6b29f89265915e585b5ee25c97"}
{"level":"info","ts":"2026-07-24T13:57:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ab19c0ec43a26b77c241c11f6a5cce44dad6a4a2fd86401faf0a0d0481ec2a4f"}
{"level":"info","ts":"2026-07-24T13:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f99fcfc4e48d94b7773247a0f78d48b8d08686203cf0fbdeae8514fd6fc2994c"}
{"level":"info","ts":"2026-07-24T13:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7aa17b7528f7ccb7970d4371622daa0502c9365a2b53a5383a6ca7e629b09f8a"}
{"level":"info","ts":"2026-07-24T13:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c7d24efa2b99867c639d4f0e27ab52426a48a1eff6c42fcbee54ec6303d6cbc3"}
{"level":"info","ts":"2026-07-24T13:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ff0107a7d527f48e078c2c4444b240d9a3c120769dd37d28d5174eedbbc03f8f"}
{"level":"info","ts":"2026-07-24T13:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/65431506b2c4dee6ba412f4884ca295eee7dee8d48dd5c9507950e3f86761867"}
{"level":"info","ts":"2026-07-24T13:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b1398387be95dc6950f4efda670c5e853e252fc5a29761ad498b4cf4e46f93a4"}