{"level":"debug","ts":"2026-07-28T20:25:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e2193f98-ce59-46d0-b987-9e9b6b42948a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:25:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e2193f98-ce59-46d0-b987-9e9b6b42948a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:25:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2193f98-ce59-46d0-b987-9e9b6b42948a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:25:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2193f98-ce59-46d0-b987-9e9b6b42948a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:25:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2193f98-ce59-46d0-b987-9e9b6b42948a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b3b657"}
{"level":"debug","ts":"2026-07-28T20:25:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2193f98-ce59-46d0-b987-9e9b6b42948a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"82147ebd-cafc-4c06-ab28-e122bd63b8df","keyName":"e2e-rate-a-b3b657","selected_subscription":"e2e-rate-iso-a-b3b657","selected_subscription_key":"ai-tenant-e2e-shared-a-bd928b/e2e-rate-iso-a-b3b657@ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b3b657","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:25:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e2193f98-ce59-46d0-b987-9e9b6b42948a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:25:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e2193f98-ce59-46d0-b987-9e9b6b42948a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:50702","PortSpecifier":{"PortValue":50702}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","method":"POST","path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions","host":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:50702","PortSpecifier":{"PortValue":50702}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270347,"nanos":448445563},"http":{"id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","method":"POST","headers":{":authority":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vSpLLvf21fMl1Z1e_OFnyCufenilqMmFMBvuxDxXFhMhxJKEc8uh8APxWFB1"}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vSpLLvf21fMl1Z1e_OFnyCufenilqMmFMBvuxDxXFhMhxJKEc8uh8APxWFB1\"}"}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"82147ebd-cafc-4c06-ab28-e122bd63b8df","keyName":"e2e-rate-a-b3b657","subscription":"e2e-rate-iso-a-b3b657","tenant":"e2e-shared-a-bd928b","userId":"82147ebd-cafc-4c06-ab28-e122bd63b8df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\",\"requestedSubscription\":\"e2e-rate-iso-a-b3b657\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b3b657","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"}}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b3b657"}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"82147ebd-cafc-4c06-ab28-e122bd63b8df","keyName":"e2e-rate-a-b3b657","selected_subscription":"e2e-rate-iso-a-b3b657","selected_subscription_key":"ai-tenant-e2e-shared-a-bd928b/e2e-rate-iso-a-b3b657@ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b3b657","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:25:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c97eb4e0-7e15-4466-8c4e-a48e3e2add7d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:50712","PortSpecifier":{"PortValue":50712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","method":"POST","path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions","host":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:50712","PortSpecifier":{"PortValue":50712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270348,"nanos":493561965},"http":{"id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","method":"POST","headers":{":authority":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vSpLLvf21fMl1Z1e_OFnyCufenilqMmFMBvuxDxXFhMhxJKEc8uh8APxWFB1"}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vSpLLvf21fMl1Z1e_OFnyCufenilqMmFMBvuxDxXFhMhxJKEc8uh8APxWFB1\"}"}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"82147ebd-cafc-4c06-ab28-e122bd63b8df","keyName":"e2e-rate-a-b3b657","subscription":"e2e-rate-iso-a-b3b657","tenant":"e2e-shared-a-bd928b","userId":"82147ebd-cafc-4c06-ab28-e122bd63b8df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\",\"requestedSubscription\":\"e2e-rate-iso-a-b3b657\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b3b657","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"}}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b3b657"}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"82147ebd-cafc-4c06-ab28-e122bd63b8df","keyName":"e2e-rate-a-b3b657","selected_subscription":"e2e-rate-iso-a-b3b657","selected_subscription_key":"ai-tenant-e2e-shared-a-bd928b/e2e-rate-iso-a-b3b657@ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b3b657","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:25:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e49c8b15-e4f8-4d23-a6af-48e016a9ac31","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39206","PortSpecifier":{"PortValue":39206}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39206","PortSpecifier":{"PortValue":39206}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270367,"nanos":832875632},"http":{"id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","method":"POST","headers":{":authority":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b2ac480d-7b6e-493d-9e22-9b436ecb9cd6","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=aaf53006-2b2a-408e-bfc9-39ce33dbe850"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/023109b166de"]}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/023109b166de"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=aaf53006-2b2a-408e-bfc9-39ce33dbe850"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b2ac480d-7b6e-493d-9e22-9b436ecb9cd6","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d14bb4659ef64655e29b2925573614b268f718c54a52a16b28b41c806b0eaf9d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c1d5a4b4-9300-4685-8cd9-3beea5bd3d4e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:57826","PortSpecifier":{"PortValue":57826}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5358589c-d369-4202-b447-fd7c9cfbd293","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-60efb4.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:57826","PortSpecifier":{"PortValue":57826}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270367,"nanos":871680184},"http":{"id":"5358589c-d369-4202-b447-fd7c9cfbd293","method":"POST","headers":{":authority":"e2e-shared-b-60efb4.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b2ac480d-7b6e-493d-9e22-9b436ecb9cd6","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=aaf53006-2b2a-408e-bfc9-39ce33dbe850"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/023109b166de"]}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/023109b166de"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=aaf53006-2b2a-408e-bfc9-39ce33dbe850"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b2ac480d-7b6e-493d-9e22-9b436ecb9cd6","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"969e68d815ef5bed467f5c0556013b80192e29e304a51976bc32e4db3bc5d361"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.56:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-60efb4.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-60efb4/rate-test-model-60efb4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-60efb4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5358589c-d369-4202-b447-fd7c9cfbd293","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39208","PortSpecifier":{"PortValue":39208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","method":"POST","path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions","host":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39208","PortSpecifier":{"PortValue":39208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270367,"nanos":911301667},"http":{"id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","method":"POST","headers":{":authority":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3\"}"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","subscription":"e2e-rate-iso-a-78fcf1","tenant":"e2e-shared-a-bd928b","userId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\",\"requestedSubscription\":\"e2e-rate-iso-a-78fcf1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-78fcf1"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","selected_subscription":"e2e-rate-iso-a-78fcf1","selected_subscription_key":"ai-tenant-e2e-shared-a-bd928b/e2e-rate-iso-a-78fcf1@ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:26:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6080ec4b-f36c-4482-95e5-e0ed634d784d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39224","PortSpecifier":{"PortValue":39224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","method":"POST","path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions","host":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39224","PortSpecifier":{"PortValue":39224}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270368,"nanos":954513260},"http":{"id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","method":"POST","headers":{":authority":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3"}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3\"}"}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","subscription":"e2e-rate-iso-a-78fcf1","tenant":"e2e-shared-a-bd928b","userId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\",\"requestedSubscription\":\"e2e-rate-iso-a-78fcf1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"}}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-78fcf1"}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","selected_subscription":"e2e-rate-iso-a-78fcf1","selected_subscription_key":"ai-tenant-e2e-shared-a-bd928b/e2e-rate-iso-a-78fcf1@ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:26:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56d37da7-ecf3-49ae-8e6e-90504725ab2f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:26:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ee161540-a81a-44fc-a067-5502c51a994c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39238","PortSpecifier":{"PortValue":39238}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ee161540-a81a-44fc-a067-5502c51a994c","method":"POST","path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions","host":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:26:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ee161540-a81a-44fc-a067-5502c51a994c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39238","PortSpecifier":{"PortValue":39238}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270369,"nanos":997092142},"http":{"id":"ee161540-a81a-44fc-a067-5502c51a994c","method":"POST","headers":{":authority":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3"}
{"level":"debug","ts":"2026-07-28T20:26:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3\"}"}
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","subscription":"e2e-rate-iso-a-78fcf1","tenant":"e2e-shared-a-bd928b","userId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\",\"requestedSubscription\":\"e2e-rate-iso-a-78fcf1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"}}
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ee161540-a81a-44fc-a067-5502c51a994c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-78fcf1"}
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ee161540-a81a-44fc-a067-5502c51a994c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","selected_subscription":"e2e-rate-iso-a-78fcf1","selected_subscription_key":"ai-tenant-e2e-shared-a-bd928b/e2e-rate-iso-a-78fcf1@ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ee161540-a81a-44fc-a067-5502c51a994c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:26:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ee161540-a81a-44fc-a067-5502c51a994c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39246","PortSpecifier":{"PortValue":39246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","method":"POST","path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions","host":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39246","PortSpecifier":{"PortValue":39246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270371,"nanos":44857953},"http":{"id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","method":"POST","headers":{":authority":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3"}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3\"}"}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","subscription":"e2e-rate-iso-a-78fcf1","tenant":"e2e-shared-a-bd928b","userId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\",\"requestedSubscription\":\"e2e-rate-iso-a-78fcf1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"}}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-78fcf1"}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","selected_subscription":"e2e-rate-iso-a-78fcf1","selected_subscription_key":"ai-tenant-e2e-shared-a-bd928b/e2e-rate-iso-a-78fcf1@ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:26:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0e5269ed-5823-4f0a-8cf8-edf4f86978d5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39252","PortSpecifier":{"PortValue":39252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","method":"POST","path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions","host":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39252","PortSpecifier":{"PortValue":39252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270372,"nanos":85687480},"http":{"id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","method":"POST","headers":{":authority":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3"}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3\"}"}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","subscription":"e2e-rate-iso-a-78fcf1","tenant":"e2e-shared-a-bd928b","userId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\",\"requestedSubscription\":\"e2e-rate-iso-a-78fcf1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"}}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-78fcf1"}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","selected_subscription":"e2e-rate-iso-a-78fcf1","selected_subscription_key":"ai-tenant-e2e-shared-a-bd928b/e2e-rate-iso-a-78fcf1@ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:26:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1d5f147c-b8c6-474f-bacb-3e4e60ac55ac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39266","PortSpecifier":{"PortValue":39266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","method":"POST","path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions","host":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39266","PortSpecifier":{"PortValue":39266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270373,"nanos":126482921},"http":{"id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","method":"POST","headers":{":authority":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3"}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3\"}"}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","subscription":"e2e-rate-iso-a-78fcf1","tenant":"e2e-shared-a-bd928b","userId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\",\"requestedSubscription\":\"e2e-rate-iso-a-78fcf1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"}}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-78fcf1"}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","selected_subscription":"e2e-rate-iso-a-78fcf1","selected_subscription_key":"ai-tenant-e2e-shared-a-bd928b/e2e-rate-iso-a-78fcf1@ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:26:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7509455f-8e90-4181-a1b3-9648ec8d74cb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39272","PortSpecifier":{"PortValue":39272}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ef49804f-8246-4f19-940a-0eef300cfaff","method":"POST","path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions","host":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39272","PortSpecifier":{"PortValue":39272}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270374,"nanos":169045593},"http":{"id":"ef49804f-8246-4f19-940a-0eef300cfaff","method":"POST","headers":{":authority":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3"}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3\"}"}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","subscription":"e2e-rate-iso-a-78fcf1","tenant":"e2e-shared-a-bd928b","userId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\",\"requestedSubscription\":\"e2e-rate-iso-a-78fcf1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"}}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-78fcf1"}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","selected_subscription":"e2e-rate-iso-a-78fcf1","selected_subscription_key":"ai-tenant-e2e-shared-a-bd928b/e2e-rate-iso-a-78fcf1@ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:26:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef49804f-8246-4f19-940a-0eef300cfaff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39286","PortSpecifier":{"PortValue":39286}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","method":"POST","path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions","host":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:39286","PortSpecifier":{"PortValue":39286}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270375,"nanos":212684057},"http":{"id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","method":"POST","headers":{":authority":"e2e-shared-a-bd928b.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-OPJ5uwZL3CPkXMju_6jPJxThYZ2lV0ulSBbXZy9PeuNVRn5YbQsDB2T6WOb3\"}"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","subscription":"e2e-rate-iso-a-78fcf1","tenant":"e2e-shared-a-bd928b","userId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\",\"requestedSubscription\":\"e2e-rate-iso-a-78fcf1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bd928b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-78fcf1"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3945e085-3b74-4fc7-a6fb-c57290ac27bb","keyName":"e2e-rate-a-78fcf1","selected_subscription":"e2e-rate-iso-a-78fcf1","selected_subscription_key":"ai-tenant-e2e-shared-a-bd928b/e2e-rate-iso-a-78fcf1@ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-bd928b/models/facebook/opt-125m","name":"rate-test-model-bd928b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-78fcf1","namespace":"ai-tenant-e2e-shared-a-bd928b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-bd928b/rate-test-model-bd928b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"289ffe88-95bb-4421-8cc4-e0c323fe2859","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:57830","PortSpecifier":{"PortValue":57830}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"416a2b84-29f9-4ef1-bd8b-37709022138d","method":"POST","path":"/ai-tenant-e2e-shared-b-60efb4/rate-test-model-60efb4/v1/completions","host":"e2e-shared-b-60efb4.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:57830","PortSpecifier":{"PortValue":57830}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270375,"nanos":251706688},"http":{"id":"416a2b84-29f9-4ef1-bd8b-37709022138d","method":"POST","headers":{":authority":"e2e-shared-b-60efb4.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-60efb4/rate-test-model-60efb4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1QQqeQrT6OLTmwioq_S06QUqPrvqaxXQUMkOTHf8vdHMsm4HM4O1NsT8UE1II"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-60efb4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1QQqeQrT6OLTmwioq_S06QUqPrvqaxXQUMkOTHf8vdHMsm4HM4O1NsT8UE1II\"}"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-60efb4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"40630e33-f02c-4b50-9bfb-487fd8c8754a","keyName":"e2e-rate-b-78fcf1","subscription":"e2e-rate-iso-b-78fcf1","tenant":"e2e-shared-b-60efb4","userId":"40630e33-f02c-4b50-9bfb-487fd8c8754a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-60efb4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-60efb4/rate-test-model-60efb4\",\"requestedSubscription\":\"e2e-rate-iso-b-78fcf1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-60efb4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-60efb4/models/facebook/opt-125m","name":"rate-test-model-60efb4","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-78fcf1","namespace":"ai-tenant-e2e-shared-b-60efb4","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-60efb4/rate-test-model-60efb4"}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-60efb4/rate-test-model-60efb4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-60efb4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-78fcf1"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"40630e33-f02c-4b50-9bfb-487fd8c8754a","keyName":"e2e-rate-b-78fcf1","selected_subscription":"e2e-rate-iso-b-78fcf1","selected_subscription_key":"ai-tenant-e2e-shared-b-60efb4/e2e-rate-iso-b-78fcf1@ai-tenant-e2e-shared-b-60efb4/rate-test-model-60efb4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-60efb4/models/facebook/opt-125m","name":"rate-test-model-60efb4","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-78fcf1","namespace":"ai-tenant-e2e-shared-b-60efb4","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-60efb4/rate-test-model-60efb4"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:26:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"416a2b84-29f9-4ef1-bd8b-37709022138d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:26:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/800b435dc6e4b10ee415d7855dc14efc9ab3319f8386f5076b4307b224e0d433"}
{"level":"info","ts":"2026-07-28T20:26:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3e4af7efbc4af1dd3cdde371a2e6006d9166ac9a74f4ec1e0c06853e26e9f4c1"}
{"level":"info","ts":"2026-07-28T20:26:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/969e68d815ef5bed467f5c0556013b80192e29e304a51976bc32e4db3bc5d361"}
{"level":"info","ts":"2026-07-28T20:26:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/06c73948450e5be7a77b9fea745cc88d644694ec19cef4e16f3533da48520b60"}
{"level":"info","ts":"2026-07-28T20:26:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9902c6ce89c00c30a8ffc4947fea786ea6c8ab1c18719893cf108b2bc1efa464"}
{"level":"info","ts":"2026-07-28T20:26:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5dcd68152dad6f0cdd3dfd73480bfadef69b1bad08718a5cda93aaf8aef175ef"}
{"level":"info","ts":"2026-07-28T20:26:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e297dda84e56f41e19e05bc01ff118be77292cf04bd24fb54665d880fcb354e2"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/80d854330afbba0ba4c9192d2224130e2bb563961d883c3b2e6385823d10d232"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4a632214313320e4012ee48e781a4b0536b3bbc2fbf0e0fccc667f2dd9d3dc99"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ac92e6024928c82cefaaaa04df83e0d3e773429eed8d7c61cda967788def702"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8b8bb2f5960e815b267ae374e1a2aa950aa86d0df8db7d610e7059c5f68818c6"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4f43cdeed048392db5a3e8852c27ae3ee6386a995b29be0ceffe8db11a1199d3"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/541fa8092e2c8e014687a82d599a1dc09486c820babb7d978ee8840476959ab9"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1542bbadc57f58bb457fdb6646875afd193ad4092f12dd6fff476ae1618b81e7"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d14bb4659ef64655e29b2925573614b268f718c54a52a16b28b41c806b0eaf9d"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b2cec14c5cfabb9ec94fac9255be373f7142ee93a0f8bd6ddbbc85e1b831812f"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/11a819389a7261544558a5eb4537ea4718ba1cd387ff7ff7efe0c776debc0cb2"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2cfd2dae571c3493bcafbcfa58b20c3420b033568cabc96909519453f8c281fe"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8796aedbde7da55de3aaa689ca9bafc823b31792910424399df5902b13c6e4c3"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/242889ba91bad536ec8827a1438f52339c3abef093e3f5e8d57f2d5d113be33b"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a16463db1181abcb7811d9547f815e24e4016a586801e2d891971e1f563eb158"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3bb38e28fed177021f76a71e4189135005af0f91cc771b42458b67b03bf852f7"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/55b22e04aa3c1cf36c7dba26c1dbfcff0272964fcdf0cf9e05d4799b301e0435"}
{"level":"info","ts":"2026-07-28T20:26:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5b966335e21ac0fd5c835a094402a0ac75b4fd125c1991cb4baee8fcb32eaf6c"}
{"level":"info","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:35726","PortSpecifier":{"PortValue":35726}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dda818ae-f126-47d4-97ec-e7f022e88220","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:35726","PortSpecifier":{"PortValue":35726}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270460,"nanos":22563012},"http":{"id":"dda818ae-f126-47d4-97ec-e7f022e88220","method":"POST","headers":{":authority":"maas.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b2ac480d-7b6e-493d-9e22-9b436ecb9cd6","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=aaf53006-2b2a-408e-bfc9-39ce33dbe850"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/023109b166de"]}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/023109b166de"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=aaf53006-2b2a-408e-bfc9-39ce33dbe850"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b2ac480d-7b6e-493d-9e22-9b436ecb9cd6","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dda818ae-f126-47d4-97ec-e7f022e88220","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:35734","PortSpecifier":{"PortValue":35734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:35734","PortSpecifier":{"PortValue":35734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270460,"nanos":73430192},"http":{"id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","method":"POST","headers":{":authority":"maas.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-v6TMn5DVz9Jm9AU1_27ZyQHw4POS0YrZdAYNvjxl1LLEZeN1vz6ArA38jfCa"}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-v6TMn5DVz9Jm9AU1_27ZyQHw4POS0YrZdAYNvjxl1LLEZeN1vz6ArA38jfCa\"}"}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ce652fb7-e4b1-498e-8c82-2ec079ceafd6","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"ce652fb7-e4b1-498e-8c82-2ec079ceafd6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ce652fb7-e4b1-498e-8c82-2ec079ceafd6","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:27:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65d02ad1-27f0-448c-ba82-59c509ce2e98","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"519bad37f76343131549cddc88ce6852153c2e1acae863075a8601f17337308e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/519bad37f76343131549cddc88ce6852153c2e1acae863075a8601f17337308e"}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"519bad37f76343131549cddc88ce6852153c2e1acae863075a8601f17337308e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"519bad37f76343131549cddc88ce6852153c2e1acae863075a8601f17337308e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["519bad37f76343131549cddc88ce6852153c2e1acae863075a8601f17337308e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"519bad37f76343131549cddc88ce6852153c2e1acae863075a8601f17337308e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/519bad37f76343131549cddc88ce6852153c2e1acae863075a8601f17337308e"}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"519bad37f76343131549cddc88ce6852153c2e1acae863075a8601f17337308e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/519bad37f76343131549cddc88ce6852153c2e1acae863075a8601f17337308e"}
{"level":"error","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38"}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38"}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2cfcc06f52cd30d140d5835cb7b6cf5816b519445f002dddb64193608e46d956","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2cfcc06f52cd30d140d5835cb7b6cf5816b519445f002dddb64193608e46d956","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cfcc06f52cd30d140d5835cb7b6cf5816b519445f002dddb64193608e46d956"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2cfcc06f52cd30d140d5835cb7b6cf5816b519445f002dddb64193608e46d956","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2cfcc06f52cd30d140d5835cb7b6cf5816b519445f002dddb64193608e46d956"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2cfcc06f52cd30d140d5835cb7b6cf5816b519445f002dddb64193608e46d956","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2cfcc06f52cd30d140d5835cb7b6cf5816b519445f002dddb64193608e46d956","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1cb34c908588094a1983f127cd56d5c6b63b620a3924d1aa3e0347d80f22367a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1cb34c908588094a1983f127cd56d5c6b63b620a3924d1aa3e0347d80f22367a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cfcc06f52cd30d140d5835cb7b6cf5816b519445f002dddb64193608e46d956"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e8df7ee1517830196e582493b8614ce4b894747a40a42effbaee634aeeb65e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e8df7ee1517830196e582493b8614ce4b894747a40a42effbaee634aeeb65e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1cb34c908588094a1983f127cd56d5c6b63b620a3924d1aa3e0347d80f22367a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1cb34c908588094a1983f127cd56d5c6b63b620a3924d1aa3e0347d80f22367a"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1cb34c908588094a1983f127cd56d5c6b63b620a3924d1aa3e0347d80f22367a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e8df7ee1517830196e582493b8614ce4b894747a40a42effbaee634aeeb65e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0e5689f70debee6b91d6ac992e0f344c6482d5c7b1fb18e4d9cec5d055cb850","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0e5689f70debee6b91d6ac992e0f344c6482d5c7b1fb18e4d9cec5d055cb850","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1cb34c908588094a1983f127cd56d5c6b63b620a3924d1aa3e0347d80f22367a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1cb34c908588094a1983f127cd56d5c6b63b620a3924d1aa3e0347d80f22367a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e8df7ee1517830196e582493b8614ce4b894747a40a42effbaee634aeeb65e8"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1cb34c908588094a1983f127cd56d5c6b63b620a3924d1aa3e0347d80f22367a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e8df7ee1517830196e582493b8614ce4b894747a40a42effbaee634aeeb65e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2e8df7ee1517830196e582493b8614ce4b894747a40a42effbaee634aeeb65e8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e8df7ee1517830196e582493b8614ce4b894747a40a42effbaee634aeeb65e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0e5689f70debee6b91d6ac992e0f344c6482d5c7b1fb18e4d9cec5d055cb850","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0e5689f70debee6b91d6ac992e0f344c6482d5c7b1fb18e4d9cec5d055cb850","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1cb34c908588094a1983f127cd56d5c6b63b620a3924d1aa3e0347d80f22367a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f73cca109102b4381fbe1c7a28740186be55a5ef250cb506094e58d0e18643a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0e5689f70debee6b91d6ac992e0f344c6482d5c7b1fb18e4d9cec5d055cb850"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f73cca109102b4381fbe1c7a28740186be55a5ef250cb506094e58d0e18643a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e8df7ee1517830196e582493b8614ce4b894747a40a42effbaee634aeeb65e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1cb34c908588094a1983f127cd56d5c6b63b620a3924d1aa3e0347d80f22367a"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0e5689f70debee6b91d6ac992e0f344c6482d5c7b1fb18e4d9cec5d055cb850","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0e5689f70debee6b91d6ac992e0f344c6482d5c7b1fb18e4d9cec5d055cb850"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0e5689f70debee6b91d6ac992e0f344c6482d5c7b1fb18e4d9cec5d055cb850","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f73cca109102b4381fbe1c7a28740186be55a5ef250cb506094e58d0e18643a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f73cca109102b4381fbe1c7a28740186be55a5ef250cb506094e58d0e18643a"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f73cca109102b4381fbe1c7a28740186be55a5ef250cb506094e58d0e18643a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0e5689f70debee6b91d6ac992e0f344c6482d5c7b1fb18e4d9cec5d055cb850","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5f73cca109102b4381fbe1c7a28740186be55a5ef250cb506094e58d0e18643a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5f73cca109102b4381fbe1c7a28740186be55a5ef250cb506094e58d0e18643a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e8df7ee1517830196e582493b8614ce4b894747a40a42effbaee634aeeb65e8"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5f73cca109102b4381fbe1c7a28740186be55a5ef250cb506094e58d0e18643a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f73cca109102b4381fbe1c7a28740186be55a5ef250cb506094e58d0e18643a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:28:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e"}
{"level":"debug","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0e5689f70debee6b91d6ac992e0f344c6482d5c7b1fb18e4d9cec5d055cb850"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f73cca109102b4381fbe1c7a28740186be55a5ef250cb506094e58d0e18643a"}
{"level":"info","ts":"2026-07-28T20:28:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b"}
{"level":"info","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:55398","PortSpecifier":{"PortValue":55398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-d7a9b9.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:55398","PortSpecifier":{"PortValue":55398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270523,"nanos":598986524},"http":{"id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","method":"POST","headers":{":authority":"e2e-ipp-a-d7a9b9.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b2ac480d-7b6e-493d-9e22-9b436ecb9cd6","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=aaf53006-2b2a-408e-bfc9-39ce33dbe850"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/023109b166de"]}}
{"level":"debug","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/023109b166de"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=aaf53006-2b2a-408e-bfc9-39ce33dbe850"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b2ac480d-7b6e-493d-9e22-9b436ecb9cd6","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-d7a9b9.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-d7a9b9/ipp-route-d7a9b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-d7a9b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:28:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f1a66545-76d7-4070-9fe0-da8fe6f221c2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:55414","PortSpecifier":{"PortValue":55414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","method":"POST","path":"/ai-tenant-e2e-ipp-a-d7a9b9/ipp-route-d7a9b9/v1/chat/completions","host":"e2e-ipp-a-d7a9b9.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:55414","PortSpecifier":{"PortValue":55414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785270525,"nanos":663481786},"http":{"id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","method":"POST","headers":{":authority":"e2e-ipp-a-d7a9b9.apps.0333d3bf-0eed-4f86-97bf-023109b166de.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-d7a9b9/ipp-route-d7a9b9/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ceP4V2NeEgMirVV6_85tCIYnDhocdAbkiuiLLggX0HUDWhzJhUfzIR9gKWpP"}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-d7a9b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ceP4V2NeEgMirVV6_85tCIYnDhocdAbkiuiLLggX0HUDWhzJhUfzIR9gKWpP\"}"}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-d7a9b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2f1bc606-ec20-44ee-9dac-b1269a969aa6","keyName":"e2e-ipp-d7a9b9","subscription":"ipp-route-d7a9b9-sub","tenant":"e2e-ipp-a-d7a9b9","userId":"2f1bc606-ec20-44ee-9dac-b1269a969aa6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-d7a9b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-d7a9b9/ipp-route-d7a9b9\",\"requestedSubscription\":\"ipp-route-d7a9b9-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-d7a9b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-d7a9b9/models/facebook/opt-125m","name":"ipp-route-d7a9b9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-d7a9b9-sub","namespace":"ai-tenant-e2e-ipp-a-d7a9b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-d7a9b9/ipp-route-d7a9b9"}}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-d7a9b9/ipp-route-d7a9b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-d7a9b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-d7a9b9-sub"}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2f1bc606-ec20-44ee-9dac-b1269a969aa6","keyName":"e2e-ipp-d7a9b9","selected_subscription":"ipp-route-d7a9b9-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-d7a9b9/ipp-route-d7a9b9-sub@ai-tenant-e2e-ipp-a-d7a9b9/ipp-route-d7a9b9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-d7a9b9/models/facebook/opt-125m","name":"ipp-route-d7a9b9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-d7a9b9-sub","namespace":"ai-tenant-e2e-ipp-a-d7a9b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-d7a9b9/ipp-route-d7a9b9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T20:28:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d44f1a69-d919-4c11-af0c-1d0fc932a500","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T20:29:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/519bad37f76343131549cddc88ce6852153c2e1acae863075a8601f17337308e"}
{"level":"info","ts":"2026-07-28T20:29:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/59f5ba6dbe045ab627332bafd59d96945587a682ce18136c0e9025f98f7de0e0"}
{"level":"info","ts":"2026-07-28T20:29:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5f73cca109102b4381fbe1c7a28740186be55a5ef250cb506094e58d0e18643a"}
{"level":"info","ts":"2026-07-28T20:29:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/080ac1014f1465df6d82198da049813cc6514214f3737a065846544b625ffb38"}
{"level":"info","ts":"2026-07-28T20:29:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d0e5689f70debee6b91d6ac992e0f344c6482d5c7b1fb18e4d9cec5d055cb850"}
{"level":"info","ts":"2026-07-28T20:29:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2cfcc06f52cd30d140d5835cb7b6cf5816b519445f002dddb64193608e46d956"}
{"level":"info","ts":"2026-07-28T20:29:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1cb34c908588094a1983f127cd56d5c6b63b620a3924d1aa3e0347d80f22367a"}
{"level":"info","ts":"2026-07-28T20:29:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2e8df7ee1517830196e582493b8614ce4b894747a40a42effbaee634aeeb65e8"}
{"level":"info","ts":"2026-07-28T20:29:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5918406b66ff32fc2f1ae96e420895d5bcd57cef48856c61a545e215db1ee39e"}
{"level":"info","ts":"2026-07-28T20:29:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8386c03e14f72d9d891efb522177414c61813ff2ce5e8195ea336eb62e50035b"}
{"level":"info","ts":"2026-07-28T20:29:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0bcafd2c2eabe1d8e859caee2191cccc4cc42e280e2b77df99c589ef79b66673"}
{"level":"info","ts":"2026-07-28T20:29:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d56173513ac503ac133b0e5166dcca93769064229b21c007ec2a7fcea1d467cb"}