{"level":"debug","ts":"2026-07-10T02:55:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a27cf88b291472af5c4428c9cab94828fb02317d9afd288122c0631bb591a274","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a27cf88b291472af5c4428c9cab94828fb02317d9afd288122c0631bb591a274"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8"}
{"level":"info","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a27cf88b291472af5c4428c9cab94828fb02317d9afd288122c0631bb591a274"}
{"level":"info","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a27cf88b291472af5c4428c9cab94828fb02317d9afd288122c0631bb591a274","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8"}
{"level":"info","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a27cf88b291472af5c4428c9cab94828fb02317d9afd288122c0631bb591a274"}
{"level":"info","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a27cf88b291472af5c4428c9cab94828fb02317d9afd288122c0631bb591a274","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8"}
{"level":"debug","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:14Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:14Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8"}
{"level":"info","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8"}
{"level":"debug","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:14Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:14Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8"}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988"}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988"}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988"}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988"}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988"}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6af47e9fafd401a33f51d18eb1020d6188508703bd1af990e7fe908a257745fd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6af47e9fafd401a33f51d18eb1020d6188508703bd1af990e7fe908a257745fd"}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6af47e9fafd401a33f51d18eb1020d6188508703bd1af990e7fe908a257745fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6af47e9fafd401a33f51d18eb1020d6188508703bd1af990e7fe908a257745fd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6af47e9fafd401a33f51d18eb1020d6188508703bd1af990e7fe908a257745fd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6af47e9fafd401a33f51d18eb1020d6188508703bd1af990e7fe908a257745fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6af47e9fafd401a33f51d18eb1020d6188508703bd1af990e7fe908a257745fd"}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6af47e9fafd401a33f51d18eb1020d6188508703bd1af990e7fe908a257745fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6af47e9fafd401a33f51d18eb1020d6188508703bd1af990e7fe908a257745fd"}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28b2f0654b968a4dcfd05bc712bab908defd9fa17263304883653474c9a65e88","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28b2f0654b968a4dcfd05bc712bab908defd9fa17263304883653474c9a65e88"}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30ed6fc50b7e0098023cdbe69dd0ef71647761004aa123ddd5678349a7f7ff77","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"info","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30ed6fc50b7e0098023cdbe69dd0ef71647761004aa123ddd5678349a7f7ff77"}
{"level":"debug","ts":"2026-07-10T02:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0cb90f8d2e82a6fc77528c5a52afed9d64b11e46b2a9a265d52a24e47119fdfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374"}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0cb90f8d2e82a6fc77528c5a52afed9d64b11e46b2a9a265d52a24e47119fdfa"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2157b5d1e8ca477f7c65054b59dab526858089433f22a7f4d4de0f402b57044","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2063d7a1a7305859efa6862cba2058350d6c1d1d1997559c57dddd8b2e9bf6e5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2157b5d1e8ca477f7c65054b59dab526858089433f22a7f4d4de0f402b57044"}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"707f119cecb60316a9e2712014924194bd19c0409d7d9d67cbba125818f9e572","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2063d7a1a7305859efa6862cba2058350d6c1d1d1997559c57dddd8b2e9bf6e5"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a27cf88b291472af5c4428c9cab94828fb02317d9afd288122c0631bb591a274","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/707f119cecb60316a9e2712014924194bd19c0409d7d9d67cbba125818f9e572"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29b29da7a2ad0e1121f6263a3949966701d8f40f6e4c62c0d0354d58d2c3271a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a27cf88b291472af5c4428c9cab94828fb02317d9afd288122c0631bb591a274"}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29b29da7a2ad0e1121f6263a3949966701d8f40f6e4c62c0d0354d58d2c3271a"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"367fb2dd41d44c1f8b8bba7560bd4a01103df781a8002c670be23938bc43f099","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ac3972ecb318117c8f4f31a381356dc9b78f3230f715c9371fc0e0e7940a3153","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/367fb2dd41d44c1f8b8bba7560bd4a01103df781a8002c670be23938bc43f099"}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"13031bb16d04f6ebbf3399e33ab04943fa34a8f6cb55f41c48ec741b32d37691","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1"}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T02:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ac3972ecb318117c8f4f31a381356dc9b78f3230f715c9371fc0e0e7940a3153"}
{"level":"error","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8653136b2ad2ac8d360ad6edca9a3bd813229678d8d4c0c2ba689c61b83c786e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/13031bb16d04f6ebbf3399e33ab04943fa34a8f6cb55f41c48ec741b32d37691"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2911975eda36b6ef52d68765a70fc00ee031d3913c0641bae89338cf2fb2d859","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"621fe045a7953de468b49b960edeb17ca015e260751e5af80bc07b506b04bc46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c4255aea4e1db8efd1f68fd736c93cad1c93df447348f3e5c14dbb6c41a5de8e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8653136b2ad2ac8d360ad6edca9a3bd813229678d8d4c0c2ba689c61b83c786e"}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2911975eda36b6ef52d68765a70fc00ee031d3913c0641bae89338cf2fb2d859"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f7b89c32f9bc07301546f54eaf9b62ca64f8f17727d26774ecd575f465d054c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/621fe045a7953de468b49b960edeb17ca015e260751e5af80bc07b506b04bc46"}
{"level":"debug","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fd6e21d33dd82db32b3b9418c437698d2415e1c42f30f6ff97deab296d24b234","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c4255aea4e1db8efd1f68fd736c93cad1c93df447348f3e5c14dbb6c41a5de8e"}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f7b89c32f9bc07301546f54eaf9b62ca64f8f17727d26774ecd575f465d054c"}
{"level":"info","ts":"2026-07-10T02:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fd6e21d33dd82db32b3b9418c437698d2415e1c42f30f6ff97deab296d24b234"}
{"level":"info","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:43538","PortSpecifier":{"PortValue":43538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b73c52da-b777-4b84-8bdf-199a9099be25","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:43538","PortSpecifier":{"PortValue":43538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652133,"nanos":900054072},"http":{"id":"b73c52da-b777-4b84-8bdf-199a9099be25","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f57a24c5-3349-4201-bb76-57629a222ea1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ecdb5a27-a9da-408c-8428-a399f0e5aa0e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9f5c3fb617ad"]}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9f5c3fb617ad"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ecdb5a27-a9da-408c-8428-a399f0e5aa0e"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f57a24c5-3349-4201-bb76-57629a222ea1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b73c52da-b777-4b84-8bdf-199a9099be25","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34050","PortSpecifier":{"PortValue":34050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"435b3c87-8d4d-495c-a544-af8fdda736f3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-de8279.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:34050","PortSpecifier":{"PortValue":34050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652133,"nanos":943400350},"http":{"id":"435b3c87-8d4d-495c-a544-af8fdda736f3","method":"POST","headers":{":authority":"e2e-shared-b-de8279.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f57a24c5-3349-4201-bb76-57629a222ea1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ecdb5a27-a9da-408c-8428-a399f0e5aa0e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9f5c3fb617ad"]}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9f5c3fb617ad"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ecdb5a27-a9da-408c-8428-a399f0e5aa0e"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f57a24c5-3349-4201-bb76-57629a222ea1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"621fe045a7953de468b49b960edeb17ca015e260751e5af80bc07b506b04bc46"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-de8279.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-de8279/rate-test-model-de8279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"435b3c87-8d4d-495c-a544-af8fdda736f3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:43542","PortSpecifier":{"PortValue":43542}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:43542","PortSpecifier":{"PortValue":43542}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652133,"nanos":988969763},"http":{"id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-oCT541FSdx71Z9ZO_88WJU3jU8otcnTP4lmdXkKHWgx9KpCv5aaYuZwymFpo"}
{"level":"debug","ts":"2026-07-10T02:55:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-oCT541FSdx71Z9ZO_88WJU3jU8otcnTP4lmdXkKHWgx9KpCv5aaYuZwymFpo\"}"}
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f537b4e-5bd4-4ee7-b86a-0a4f4773f24c","keyName":"e2e-rate-a-4a3b9d","subscription":"e2e-rate-iso-a-4a3b9d","tenant":"e2e-shared-a-d5b98a","userId":"6f537b4e-5bd4-4ee7-b86a-0a4f4773f24c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\",\"requestedSubscription\":\"e2e-rate-iso-a-4a3b9d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4a3b9d","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4a3b9d"}
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f537b4e-5bd4-4ee7-b86a-0a4f4773f24c","keyName":"e2e-rate-a-4a3b9d","selected_subscription":"e2e-rate-iso-a-4a3b9d","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b98a/e2e-rate-iso-a-4a3b9d@ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4a3b9d","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6d05a418-c4dc-4087-b152-7607dc9f0c69","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:43550","PortSpecifier":{"PortValue":43550}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:43550","PortSpecifier":{"PortValue":43550}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652135,"nanos":53149986},"http":{"id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-oCT541FSdx71Z9ZO_88WJU3jU8otcnTP4lmdXkKHWgx9KpCv5aaYuZwymFpo"}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-oCT541FSdx71Z9ZO_88WJU3jU8otcnTP4lmdXkKHWgx9KpCv5aaYuZwymFpo\"}"}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f537b4e-5bd4-4ee7-b86a-0a4f4773f24c","keyName":"e2e-rate-a-4a3b9d","subscription":"e2e-rate-iso-a-4a3b9d","tenant":"e2e-shared-a-d5b98a","userId":"6f537b4e-5bd4-4ee7-b86a-0a4f4773f24c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\",\"requestedSubscription\":\"e2e-rate-iso-a-4a3b9d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4a3b9d","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4a3b9d"}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f537b4e-5bd4-4ee7-b86a-0a4f4773f24c","keyName":"e2e-rate-a-4a3b9d","selected_subscription":"e2e-rate-iso-a-4a3b9d","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b98a/e2e-rate-iso-a-4a3b9d@ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4a3b9d","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e3ec93e-2971-49f0-8bd2-0ea571f15b26","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:43554","PortSpecifier":{"PortValue":43554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:43554","PortSpecifier":{"PortValue":43554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652136,"nanos":112700292},"http":{"id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-oCT541FSdx71Z9ZO_88WJU3jU8otcnTP4lmdXkKHWgx9KpCv5aaYuZwymFpo"}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-oCT541FSdx71Z9ZO_88WJU3jU8otcnTP4lmdXkKHWgx9KpCv5aaYuZwymFpo\"}"}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f537b4e-5bd4-4ee7-b86a-0a4f4773f24c","keyName":"e2e-rate-a-4a3b9d","subscription":"e2e-rate-iso-a-4a3b9d","tenant":"e2e-shared-a-d5b98a","userId":"6f537b4e-5bd4-4ee7-b86a-0a4f4773f24c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\",\"requestedSubscription\":\"e2e-rate-iso-a-4a3b9d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4a3b9d","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4a3b9d"}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f537b4e-5bd4-4ee7-b86a-0a4f4773f24c","keyName":"e2e-rate-a-4a3b9d","selected_subscription":"e2e-rate-iso-a-4a3b9d","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b98a/e2e-rate-iso-a-4a3b9d@ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4a3b9d","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b4a5c79-4731-4d6c-88fc-0034e79b54b7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44502398-9887-4cc9-a039-918f877cac2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46592","PortSpecifier":{"PortValue":46592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"44502398-9887-4cc9-a039-918f877cac2b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44502398-9887-4cc9-a039-918f877cac2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46592","PortSpecifier":{"PortValue":46592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652147,"nanos":49932080},"http":{"id":"44502398-9887-4cc9-a039-918f877cac2b","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"44502398-9887-4cc9-a039-918f877cac2b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"44502398-9887-4cc9-a039-918f877cac2b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f57a24c5-3349-4201-bb76-57629a222ea1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ecdb5a27-a9da-408c-8428-a399f0e5aa0e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9f5c3fb617ad"]}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"44502398-9887-4cc9-a039-918f877cac2b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9f5c3fb617ad"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ecdb5a27-a9da-408c-8428-a399f0e5aa0e"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f57a24c5-3349-4201-bb76-57629a222ea1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44502398-9887-4cc9-a039-918f877cac2b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44502398-9887-4cc9-a039-918f877cac2b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44502398-9887-4cc9-a039-918f877cac2b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"44502398-9887-4cc9-a039-918f877cac2b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44502398-9887-4cc9-a039-918f877cac2b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44502398-9887-4cc9-a039-918f877cac2b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44502398-9887-4cc9-a039-918f877cac2b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44502398-9887-4cc9-a039-918f877cac2b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:49636","PortSpecifier":{"PortValue":49636}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-de8279.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:49636","PortSpecifier":{"PortValue":49636}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652147,"nanos":88751066},"http":{"id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","method":"POST","headers":{":authority":"e2e-shared-b-de8279.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f57a24c5-3349-4201-bb76-57629a222ea1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ecdb5a27-a9da-408c-8428-a399f0e5aa0e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9f5c3fb617ad"]}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9f5c3fb617ad"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ecdb5a27-a9da-408c-8428-a399f0e5aa0e"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f57a24c5-3349-4201-bb76-57629a222ea1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"621fe045a7953de468b49b960edeb17ca015e260751e5af80bc07b506b04bc46"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-de8279.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-de8279/rate-test-model-de8279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af9eb125-1d7d-4c5e-96fb-f5ba34ce9c1d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46598","PortSpecifier":{"PortValue":46598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46598","PortSpecifier":{"PortValue":46598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652147,"nanos":138542605},"http":{"id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY\"}"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","subscription":"e2e-rate-iso-a-837302","tenant":"e2e-shared-a-d5b98a","userId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\",\"requestedSubscription\":\"e2e-rate-iso-a-837302\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-837302"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","selected_subscription":"e2e-rate-iso-a-837302","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b98a/e2e-rate-iso-a-837302@ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"deaa77d2-50cf-4ebc-9452-4cb4e6618ad4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46602","PortSpecifier":{"PortValue":46602}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46602","PortSpecifier":{"PortValue":46602}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652148,"nanos":181999091},"http":{"id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY"}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY\"}"}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","subscription":"e2e-rate-iso-a-837302","tenant":"e2e-shared-a-d5b98a","userId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\",\"requestedSubscription\":\"e2e-rate-iso-a-837302\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-837302"}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","selected_subscription":"e2e-rate-iso-a-837302","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b98a/e2e-rate-iso-a-837302@ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"698a71d9-83d7-4b47-ac14-ea5c8a4667cb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a0765825-ce30-459b-b650-1f536c6759cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46606","PortSpecifier":{"PortValue":46606}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a0765825-ce30-459b-b650-1f536c6759cb","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a0765825-ce30-459b-b650-1f536c6759cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46606","PortSpecifier":{"PortValue":46606}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652149,"nanos":219593622},"http":{"id":"a0765825-ce30-459b-b650-1f536c6759cb","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY"}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY\"}"}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","subscription":"e2e-rate-iso-a-837302","tenant":"e2e-shared-a-d5b98a","userId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\",\"requestedSubscription\":\"e2e-rate-iso-a-837302\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a0765825-ce30-459b-b650-1f536c6759cb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-837302"}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0765825-ce30-459b-b650-1f536c6759cb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","selected_subscription":"e2e-rate-iso-a-837302","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b98a/e2e-rate-iso-a-837302@ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a0765825-ce30-459b-b650-1f536c6759cb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a0765825-ce30-459b-b650-1f536c6759cb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46610","PortSpecifier":{"PortValue":46610}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46610","PortSpecifier":{"PortValue":46610}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652150,"nanos":257433633},"http":{"id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY"}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY\"}"}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","subscription":"e2e-rate-iso-a-837302","tenant":"e2e-shared-a-d5b98a","userId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\",\"requestedSubscription\":\"e2e-rate-iso-a-837302\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-837302"}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","selected_subscription":"e2e-rate-iso-a-837302","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b98a/e2e-rate-iso-a-837302@ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35e0d926-5fbc-4ad4-846f-c3a2b839fc46","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46620","PortSpecifier":{"PortValue":46620}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46620","PortSpecifier":{"PortValue":46620}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652151,"nanos":292388483},"http":{"id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY"}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY\"}"}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","subscription":"e2e-rate-iso-a-837302","tenant":"e2e-shared-a-d5b98a","userId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\",\"requestedSubscription\":\"e2e-rate-iso-a-837302\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-837302"}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","selected_subscription":"e2e-rate-iso-a-837302","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b98a/e2e-rate-iso-a-837302@ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a91f05be-d073-4ab4-883d-17d89a6f7f01","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46628","PortSpecifier":{"PortValue":46628}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46628","PortSpecifier":{"PortValue":46628}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652152,"nanos":331956072},"http":{"id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY"}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY\"}"}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","subscription":"e2e-rate-iso-a-837302","tenant":"e2e-shared-a-d5b98a","userId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\",\"requestedSubscription\":\"e2e-rate-iso-a-837302\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-837302"}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","selected_subscription":"e2e-rate-iso-a-837302","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b98a/e2e-rate-iso-a-837302@ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c2a8346-85ec-42dc-a949-e61b45bcdcd7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46642","PortSpecifier":{"PortValue":46642}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46642","PortSpecifier":{"PortValue":46642}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652153,"nanos":366476574},"http":{"id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY"}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY\"}"}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","subscription":"e2e-rate-iso-a-837302","tenant":"e2e-shared-a-d5b98a","userId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\",\"requestedSubscription\":\"e2e-rate-iso-a-837302\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-837302"}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","selected_subscription":"e2e-rate-iso-a-837302","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b98a/e2e-rate-iso-a-837302@ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"06209a84-9b86-9dc7-a8e6-8adfceba6a9f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46656","PortSpecifier":{"PortValue":46656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"64eb7a57-93a3-4f9c-bead-127510b5a672","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46656","PortSpecifier":{"PortValue":46656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652154,"nanos":402494323},"http":{"id":"64eb7a57-93a3-4f9c-bead-127510b5a672","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY"}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY\"}"}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","subscription":"e2e-rate-iso-a-837302","tenant":"e2e-shared-a-d5b98a","userId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\",\"requestedSubscription\":\"e2e-rate-iso-a-837302\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-837302"}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","selected_subscription":"e2e-rate-iso-a-837302","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b98a/e2e-rate-iso-a-837302@ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"64eb7a57-93a3-4f9c-bead-127510b5a672","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46666","PortSpecifier":{"PortValue":46666}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","method":"POST","path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions","host":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46666","PortSpecifier":{"PortValue":46666}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652155,"nanos":441209010},"http":{"id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","method":"POST","headers":{":authority":"e2e-shared-a-d5b98a.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-txRMpcXs7l2RbrKM_Lxq4Pst8PqHgOejjRV8W21jA33HPp6z51cSxK6FOOvY\"}"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","subscription":"e2e-rate-iso-a-837302","tenant":"e2e-shared-a-d5b98a","userId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\",\"requestedSubscription\":\"e2e-rate-iso-a-837302\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d5b98a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-837302"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1b1db245-647c-4ba7-a9ef-42b31568cf1d","keyName":"e2e-rate-a-837302","selected_subscription":"e2e-rate-iso-a-837302","selected_subscription_key":"ai-tenant-e2e-shared-a-d5b98a/e2e-rate-iso-a-837302@ai-tenant-e2e-shared-a-d5b98a/rate-test-model-d5b98a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d5b98a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-837302","namespace":"ai-tenant-e2e-shared-a-d5b98a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1bfb2c14-3b9f-4edd-99ed-fd743f62adbb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"025e0634-a68d-4573-8dad-4b08912a1def","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:49644","PortSpecifier":{"PortValue":49644}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"025e0634-a68d-4573-8dad-4b08912a1def","method":"POST","path":"/ai-tenant-e2e-shared-b-de8279/rate-test-model-de8279/v1/completions","host":"e2e-shared-b-de8279.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"025e0634-a68d-4573-8dad-4b08912a1def","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:49644","PortSpecifier":{"PortValue":49644}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783652155,"nanos":476587522},"http":{"id":"025e0634-a68d-4573-8dad-4b08912a1def","method":"POST","headers":{":authority":"e2e-shared-b-de8279.apps.0c3a1b80-7065-4d35-a30e-9f5c3fb617ad.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-de8279/rate-test-model-de8279/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-U9Ds1TJPgdxXBU0y_horaRV7jXnnz2hJb6Izh4edu0doK9w7s5ZFFYd6Ptgq"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-de8279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-U9Ds1TJPgdxXBU0y_horaRV7jXnnz2hJb6Izh4edu0doK9w7s5ZFFYd6Ptgq\"}"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-de8279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd1bc21f-88c6-4576-aa06-e291b8228dd6","keyName":"e2e-rate-b-837302","subscription":"e2e-rate-iso-b-837302","tenant":"e2e-shared-b-de8279","userId":"cd1bc21f-88c6-4576-aa06-e291b8228dd6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-de8279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-de8279/rate-test-model-de8279\",\"requestedSubscription\":\"e2e-rate-iso-b-837302\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-de8279.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-de8279","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-837302","namespace":"ai-tenant-e2e-shared-b-de8279","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"025e0634-a68d-4573-8dad-4b08912a1def","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-de8279/rate-test-model-de8279\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-837302"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"025e0634-a68d-4573-8dad-4b08912a1def","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd1bc21f-88c6-4576-aa06-e291b8228dd6","keyName":"e2e-rate-b-837302","selected_subscription":"e2e-rate-iso-b-837302","selected_subscription_key":"ai-tenant-e2e-shared-b-de8279/e2e-rate-iso-b-837302@ai-tenant-e2e-shared-b-de8279/rate-test-model-de8279","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-de8279","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-837302","namespace":"ai-tenant-e2e-shared-b-de8279","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"025e0634-a68d-4573-8dad-4b08912a1def","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T02:55:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"025e0634-a68d-4573-8dad-4b08912a1def","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b7c2cbe281a2440d00243b66c4ecac694ab5560b1c85cce55161d8b93a78e0cd"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8653136b2ad2ac8d360ad6edca9a3bd813229678d8d4c0c2ba689c61b83c786e"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d2157b5d1e8ca477f7c65054b59dab526858089433f22a7f4d4de0f402b57044"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fd6e21d33dd82db32b3b9418c437698d2415e1c42f30f6ff97deab296d24b234"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2854b265d3713a18458f4c70d004ee7a904e1079143273399db34bf255b5fbd8"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/29b29da7a2ad0e1121f6263a3949966701d8f40f6e4c62c0d0354d58d2c3271a"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a27cf88b291472af5c4428c9cab94828fb02317d9afd288122c0631bb591a274"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c4255aea4e1db8efd1f68fd736c93cad1c93df447348f3e5c14dbb6c41a5de8e"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b240d1171784846d4fe46a5c503fb77b990915cef9a4d1e6405f9e6cec17855e"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2911975eda36b6ef52d68765a70fc00ee031d3913c0641bae89338cf2fb2d859"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/30ed6fc50b7e0098023cdbe69dd0ef71647761004aa123ddd5678349a7f7ff77"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/367fb2dd41d44c1f8b8bba7560bd4a01103df781a8002c670be23938bc43f099"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ac3972ecb318117c8f4f31a381356dc9b78f3230f715c9371fc0e0e7940a3153"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/16042a4540bd3350fa746c839df0bd588e2fd961f1752bd6e1c3d8bbaafb2988"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2063d7a1a7305859efa6862cba2058350d6c1d1d1997559c57dddd8b2e9bf6e5"}
{"level":"info","ts":"2026-07-10T02:56:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ab8dcdf999e749e710c1e7a5a686ae4956ba4999a675814cdae1915e271bdcd1"}
{"level":"info","ts":"2026-07-10T02:56:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/28b2f0654b968a4dcfd05bc712bab908defd9fa17263304883653474c9a65e88"}
{"level":"info","ts":"2026-07-10T02:56:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b0414b83283b9dac3a6c6ecb0ee13025e9c7f368f0503f8e009e14c2555a374"}
{"level":"info","ts":"2026-07-10T02:56:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6af47e9fafd401a33f51d18eb1020d6188508703bd1af990e7fe908a257745fd"}
{"level":"info","ts":"2026-07-10T02:56:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0cb90f8d2e82a6fc77528c5a52afed9d64b11e46b2a9a265d52a24e47119fdfa"}
{"level":"info","ts":"2026-07-10T02:56:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/707f119cecb60316a9e2712014924194bd19c0409d7d9d67cbba125818f9e572"}
{"level":"info","ts":"2026-07-10T02:56:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6f7b89c32f9bc07301546f54eaf9b62ca64f8f17727d26774ecd575f465d054c"}
{"level":"info","ts":"2026-07-10T02:56:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/621fe045a7953de468b49b960edeb17ca015e260751e5af80bc07b506b04bc46"}
{"level":"info","ts":"2026-07-10T02:56:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/13031bb16d04f6ebbf3399e33ab04943fa34a8f6cb55f41c48ec741b32d37691"}