{"level":"debug","ts":"2026-07-24T04:06:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dfe0a260-cb47-47ac-b83b-1bc39ab24e1b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dfe0a260-cb47-47ac-b83b-1bc39ab24e1b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dfe0a260-cb47-47ac-b83b-1bc39ab24e1b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-5b56b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dfe0a260-cb47-47ac-b83b-1bc39ab24e1b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dfe0a260-cb47-47ac-b83b-1bc39ab24e1b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:06:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dfe0a260-cb47-47ac-b83b-1bc39ab24e1b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eed5f4"}
{"level":"debug","ts":"2026-07-24T04:06:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dfe0a260-cb47-47ac-b83b-1bc39ab24e1b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T04:06:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dfe0a260-cb47-47ac-b83b-1bc39ab24e1b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"04eeb833-a362-4cfe-a633-cf7318d29d78","keyName":"e2e-rate-a-eed5f4","selected_subscription":"e2e-rate-iso-a-eed5f4","selected_subscription_key":"ai-tenant-e2e-shared-a-5b56b9/e2e-rate-iso-a-eed5f4@ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eed5f4","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T04:06:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dfe0a260-cb47-47ac-b83b-1bc39ab24e1b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:06:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dfe0a260-cb47-47ac-b83b-1bc39ab24e1b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:40626","PortSpecifier":{"PortValue":40626}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","method":"POST","path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions","host":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:40626","PortSpecifier":{"PortValue":40626}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784865968,"nanos":759696579},"http":{"id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","method":"POST","headers":{":authority":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cMOlFfMRt3FHoQIS_Qt9AeM1TnteCyodh33obTqMq9ZLCxQ2A9y4XSpvYGhC"}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cMOlFfMRt3FHoQIS_Qt9AeM1TnteCyodh33obTqMq9ZLCxQ2A9y4XSpvYGhC\"}"}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"04eeb833-a362-4cfe-a633-cf7318d29d78","keyName":"e2e-rate-a-eed5f4","subscription":"e2e-rate-iso-a-eed5f4","tenant":"e2e-shared-a-5b56b9","userId":"04eeb833-a362-4cfe-a633-cf7318d29d78","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\",\"requestedSubscription\":\"e2e-rate-iso-a-eed5f4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eed5f4","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"}}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-5b56b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eed5f4"}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"04eeb833-a362-4cfe-a633-cf7318d29d78","keyName":"e2e-rate-a-eed5f4","selected_subscription":"e2e-rate-iso-a-eed5f4","selected_subscription_key":"ai-tenant-e2e-shared-a-5b56b9/e2e-rate-iso-a-eed5f4@ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eed5f4","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:06:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7e6f2e0-5bb6-4e41-ab6f-be33a4420b83","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:40634","PortSpecifier":{"PortValue":40634}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d5e624c4-512a-4e24-8739-b0729bc802e9","method":"POST","path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions","host":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:40634","PortSpecifier":{"PortValue":40634}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784865969,"nanos":803094063},"http":{"id":"d5e624c4-512a-4e24-8739-b0729bc802e9","method":"POST","headers":{":authority":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cMOlFfMRt3FHoQIS_Qt9AeM1TnteCyodh33obTqMq9ZLCxQ2A9y4XSpvYGhC"}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cMOlFfMRt3FHoQIS_Qt9AeM1TnteCyodh33obTqMq9ZLCxQ2A9y4XSpvYGhC\"}"}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"04eeb833-a362-4cfe-a633-cf7318d29d78","keyName":"e2e-rate-a-eed5f4","subscription":"e2e-rate-iso-a-eed5f4","tenant":"e2e-shared-a-5b56b9","userId":"04eeb833-a362-4cfe-a633-cf7318d29d78","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\",\"requestedSubscription\":\"e2e-rate-iso-a-eed5f4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eed5f4","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"}}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-5b56b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eed5f4"}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"04eeb833-a362-4cfe-a633-cf7318d29d78","keyName":"e2e-rate-a-eed5f4","selected_subscription":"e2e-rate-iso-a-eed5f4","selected_subscription_key":"ai-tenant-e2e-shared-a-5b56b9/e2e-rate-iso-a-eed5f4@ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eed5f4","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:06:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5e624c4-512a-4e24-8739-b0729bc802e9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:40640","PortSpecifier":{"PortValue":40640}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","method":"POST","path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions","host":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:40640","PortSpecifier":{"PortValue":40640}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784865970,"nanos":846612066},"http":{"id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","method":"POST","headers":{":authority":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cMOlFfMRt3FHoQIS_Qt9AeM1TnteCyodh33obTqMq9ZLCxQ2A9y4XSpvYGhC"}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cMOlFfMRt3FHoQIS_Qt9AeM1TnteCyodh33obTqMq9ZLCxQ2A9y4XSpvYGhC\"}"}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"04eeb833-a362-4cfe-a633-cf7318d29d78","keyName":"e2e-rate-a-eed5f4","subscription":"e2e-rate-iso-a-eed5f4","tenant":"e2e-shared-a-5b56b9","userId":"04eeb833-a362-4cfe-a633-cf7318d29d78","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\",\"requestedSubscription\":\"e2e-rate-iso-a-eed5f4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eed5f4","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"}}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-5b56b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eed5f4"}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"04eeb833-a362-4cfe-a633-cf7318d29d78","keyName":"e2e-rate-a-eed5f4","selected_subscription":"e2e-rate-iso-a-eed5f4","selected_subscription_key":"ai-tenant-e2e-shared-a-5b56b9/e2e-rate-iso-a-eed5f4@ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eed5f4","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:06:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78c0292b-a2df-4206-9e3d-7e8961d0a125","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:52590","PortSpecifier":{"PortValue":52590}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","method":"POST","path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions","host":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:52590","PortSpecifier":{"PortValue":52590}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784865971,"nanos":884019377},"http":{"id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","method":"POST","headers":{":authority":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cMOlFfMRt3FHoQIS_Qt9AeM1TnteCyodh33obTqMq9ZLCxQ2A9y4XSpvYGhC"}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cMOlFfMRt3FHoQIS_Qt9AeM1TnteCyodh33obTqMq9ZLCxQ2A9y4XSpvYGhC\"}"}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"04eeb833-a362-4cfe-a633-cf7318d29d78","keyName":"e2e-rate-a-eed5f4","subscription":"e2e-rate-iso-a-eed5f4","tenant":"e2e-shared-a-5b56b9","userId":"04eeb833-a362-4cfe-a633-cf7318d29d78","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\",\"requestedSubscription\":\"e2e-rate-iso-a-eed5f4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eed5f4","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"}}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-5b56b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eed5f4"}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"04eeb833-a362-4cfe-a633-cf7318d29d78","keyName":"e2e-rate-a-eed5f4","selected_subscription":"e2e-rate-iso-a-eed5f4","selected_subscription_key":"ai-tenant-e2e-shared-a-5b56b9/e2e-rate-iso-a-eed5f4@ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eed5f4","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:06:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"14fdc30b-548d-4ec8-9d1e-53649948e92b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:52606","PortSpecifier":{"PortValue":52606}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"941418c0-3d91-46bb-b8ac-efa8967978d2","method":"POST","path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions","host":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:52606","PortSpecifier":{"PortValue":52606}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784865972,"nanos":925958855},"http":{"id":"941418c0-3d91-46bb-b8ac-efa8967978d2","method":"POST","headers":{":authority":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-cMOlFfMRt3FHoQIS_Qt9AeM1TnteCyodh33obTqMq9ZLCxQ2A9y4XSpvYGhC"}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-cMOlFfMRt3FHoQIS_Qt9AeM1TnteCyodh33obTqMq9ZLCxQ2A9y4XSpvYGhC\"}"}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"04eeb833-a362-4cfe-a633-cf7318d29d78","keyName":"e2e-rate-a-eed5f4","subscription":"e2e-rate-iso-a-eed5f4","tenant":"e2e-shared-a-5b56b9","userId":"04eeb833-a362-4cfe-a633-cf7318d29d78","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\",\"requestedSubscription\":\"e2e-rate-iso-a-eed5f4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eed5f4","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"}}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-5b56b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eed5f4"}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"04eeb833-a362-4cfe-a633-cf7318d29d78","keyName":"e2e-rate-a-eed5f4","selected_subscription":"e2e-rate-iso-a-eed5f4","selected_subscription_key":"ai-tenant-e2e-shared-a-5b56b9/e2e-rate-iso-a-eed5f4@ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eed5f4","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:06:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"941418c0-3d91-46bb-b8ac-efa8967978d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:55586","PortSpecifier":{"PortValue":55586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1fa623f3-762f-493b-9803-c2fc913a44ea","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:55586","PortSpecifier":{"PortValue":55586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784865981,"nanos":600266237},"http":{"id":"1fa623f3-762f-493b-9803-c2fc913a44ea","method":"POST","headers":{":authority":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9523052d-992f-40d0-a8e6-47495ccf8da0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fe0e81c1-59f4-4fa9-bf87-1a985833e60b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e3741adc75f3"]}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e3741adc75f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fe0e81c1-59f4-4fa9-bf87-1a985833e60b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9523052d-992f-40d0-a8e6-47495ccf8da0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5e08292505f905146574ca4eff9ba7ccc68b9128bfd761e52a64c50be4ec512a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.67:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-5b56b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fa623f3-762f-493b-9803-c2fc913a44ea","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:52230","PortSpecifier":{"PortValue":52230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cdfbe6cd-2078-4631-9544-d9379c888e85","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f701e0.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:52230","PortSpecifier":{"PortValue":52230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784865981,"nanos":637755026},"http":{"id":"cdfbe6cd-2078-4631-9544-d9379c888e85","method":"POST","headers":{":authority":"e2e-shared-b-f701e0.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9523052d-992f-40d0-a8e6-47495ccf8da0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fe0e81c1-59f4-4fa9-bf87-1a985833e60b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e3741adc75f3"]}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e3741adc75f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fe0e81c1-59f4-4fa9-bf87-1a985833e60b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9523052d-992f-40d0-a8e6-47495ccf8da0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"00dde76e7da444eeb898f0c89a350b3cf70a88c6347a52ae9ec8574b4b62b0f7"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f701e0.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f701e0/rate-test-model-f701e0\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-f701e0/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cdfbe6cd-2078-4631-9544-d9379c888e85","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:55592","PortSpecifier":{"PortValue":55592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","method":"POST","path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions","host":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:55592","PortSpecifier":{"PortValue":55592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784865981,"nanos":672450491},"http":{"id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","method":"POST","headers":{":authority":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5wldGtJkqltLybM9_PXdIEvTizPWbXuOrhM9Cc4FPthe19CTVjZdMDDJ2K16"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5wldGtJkqltLybM9_PXdIEvTizPWbXuOrhM9Cc4FPthe19CTVjZdMDDJ2K16\"}"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"237bd712-07c5-4a37-9a63-dfbaa870b9cb","keyName":"e2e-rate-a-92966b","subscription":"e2e-rate-iso-a-92966b","tenant":"e2e-shared-a-5b56b9","userId":"237bd712-07c5-4a37-9a63-dfbaa870b9cb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\",\"requestedSubscription\":\"e2e-rate-iso-a-92966b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-92966b","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-5b56b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-92966b"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"237bd712-07c5-4a37-9a63-dfbaa870b9cb","keyName":"e2e-rate-a-92966b","selected_subscription":"e2e-rate-iso-a-92966b","selected_subscription_key":"ai-tenant-e2e-shared-a-5b56b9/e2e-rate-iso-a-92966b@ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-92966b","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:06:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cd98d0b-987f-4afb-adaa-8423acdda0bd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:55598","PortSpecifier":{"PortValue":55598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","method":"POST","path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions","host":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:55598","PortSpecifier":{"PortValue":55598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784865982,"nanos":715098929},"http":{"id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","method":"POST","headers":{":authority":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5wldGtJkqltLybM9_PXdIEvTizPWbXuOrhM9Cc4FPthe19CTVjZdMDDJ2K16"}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5wldGtJkqltLybM9_PXdIEvTizPWbXuOrhM9Cc4FPthe19CTVjZdMDDJ2K16\"}"}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"237bd712-07c5-4a37-9a63-dfbaa870b9cb","keyName":"e2e-rate-a-92966b","subscription":"e2e-rate-iso-a-92966b","tenant":"e2e-shared-a-5b56b9","userId":"237bd712-07c5-4a37-9a63-dfbaa870b9cb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\",\"requestedSubscription\":\"e2e-rate-iso-a-92966b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-92966b","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"}}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-5b56b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-92966b"}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"237bd712-07c5-4a37-9a63-dfbaa870b9cb","keyName":"e2e-rate-a-92966b","selected_subscription":"e2e-rate-iso-a-92966b","selected_subscription_key":"ai-tenant-e2e-shared-a-5b56b9/e2e-rate-iso-a-92966b@ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-92966b","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:06:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e557e8c-6ecc-444d-8528-ca9aca4334a5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:55600","PortSpecifier":{"PortValue":55600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","method":"POST","path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions","host":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:55600","PortSpecifier":{"PortValue":55600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784865983,"nanos":760030862},"http":{"id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","method":"POST","headers":{":authority":"e2e-shared-a-5b56b9.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-5wldGtJkqltLybM9_PXdIEvTizPWbXuOrhM9Cc4FPthe19CTVjZdMDDJ2K16"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-5wldGtJkqltLybM9_PXdIEvTizPWbXuOrhM9Cc4FPthe19CTVjZdMDDJ2K16\"}"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"237bd712-07c5-4a37-9a63-dfbaa870b9cb","keyName":"e2e-rate-a-92966b","subscription":"e2e-rate-iso-a-92966b","tenant":"e2e-shared-a-5b56b9","userId":"237bd712-07c5-4a37-9a63-dfbaa870b9cb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\",\"requestedSubscription\":\"e2e-rate-iso-a-92966b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5b56b9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-92966b","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-5b56b9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-92966b"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"237bd712-07c5-4a37-9a63-dfbaa870b9cb","keyName":"e2e-rate-a-92966b","selected_subscription":"e2e-rate-iso-a-92966b","selected_subscription_key":"ai-tenant-e2e-shared-a-5b56b9/e2e-rate-iso-a-92966b@ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5b56b9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-92966b","namespace":"ai-tenant-e2e-shared-a-5b56b9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-5b56b9/rate-test-model-5b56b9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b513947-42c2-4fcc-923f-bad00b1e2e9b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:52234","PortSpecifier":{"PortValue":52234}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","method":"POST","path":"/ai-tenant-e2e-shared-b-f701e0/rate-test-model-f701e0/v1/completions","host":"e2e-shared-b-f701e0.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:52234","PortSpecifier":{"PortValue":52234}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784865983,"nanos":797805173},"http":{"id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","method":"POST","headers":{":authority":"e2e-shared-b-f701e0.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-f701e0/rate-test-model-f701e0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1aqDbeg5v4m2tDGgV_BrLvHmEazNagRAmhnOIGck1dykFYaahBZnNOwm2ngLg"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-f701e0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1aqDbeg5v4m2tDGgV_BrLvHmEazNagRAmhnOIGck1dykFYaahBZnNOwm2ngLg\"}"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f701e0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"226e1660-2168-4ca0-9d49-7fa957f1449c","keyName":"e2e-rate-b-92966b","subscription":"e2e-rate-iso-b-92966b","tenant":"e2e-shared-b-f701e0","userId":"226e1660-2168-4ca0-9d49-7fa957f1449c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-f701e0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-f701e0/rate-test-model-f701e0\",\"requestedSubscription\":\"e2e-rate-iso-b-92966b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f701e0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-f701e0","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-92966b","namespace":"ai-tenant-e2e-shared-b-f701e0","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-f701e0/rate-test-model-f701e0"}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f701e0/rate-test-model-f701e0\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-f701e0/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-92966b"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"226e1660-2168-4ca0-9d49-7fa957f1449c","keyName":"e2e-rate-b-92966b","selected_subscription":"e2e-rate-iso-b-92966b","selected_subscription_key":"ai-tenant-e2e-shared-b-f701e0/e2e-rate-iso-b-92966b@ai-tenant-e2e-shared-b-f701e0/rate-test-model-f701e0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-f701e0","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-92966b","namespace":"ai-tenant-e2e-shared-b-f701e0","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-f701e0/rate-test-model-f701e0"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:06:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cfa9288-ca62-4344-a452-5d37c57fa3c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2711a468b1313c3d22ad97d51e3306b17f3c39e55dcfd95b25a8edf72562dd61"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6dfa0ab688426d8623808747ab95166d71bc723166cbd3e676280cac0d306c06"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/01dd703280a3ec77343046c6de82b4942ebb89bfb07dd216290a0b75f330e3e5"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/185549ec73cdfc720e201ad6bad3c12751d60a70e98087e01bcaee2d66f58a48"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5e08292505f905146574ca4eff9ba7ccc68b9128bfd761e52a64c50be4ec512a"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/786ccaa38f5d875803255d078ace7ed3a99fffbf01c06e322520d14d4be71532"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/00dde76e7da444eeb898f0c89a350b3cf70a88c6347a52ae9ec8574b4b62b0f7"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9edc3ec0fe816c22f70c127131ea4b5455e4bf6df98a7f6fa9a5c6a6024e5542"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9c2f013ddb22d68626069dcc4395b7c7bdfbfb8a4ae19b7d3e04e3115ac09659"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/71bb25b3929d662a0821229cc9db00e37d79418ef80d8c406cd0e063ba39fc1d"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1b15ae18e47ce27353ded1886aa4cc0257047a5bf1f8265ed294155447b54d0b"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ab6b0d1bdb692aeede189be909241be2397f0d2fe7aca4d586f4ccc60fb98563"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d66b0517af56aacaaca574117ced0f57c9a4356cfdd4974a2b1855fc1b1f3c59"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7eec989e4987adbaab55716cff4f8df878bfc46d7868eaf6e25c324a17e1501a"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/458f23bfe98e0ae934c1218079b5f6fd62762134fc92726a6c2577aff36693b4"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0df146297fd5fcc5201f994016cb068d8bf59d4a98b74756ddd097ff0b63e529"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1c2a00c0bcfe2ca129ef733442534badf1927c36ded0ee140764342c6ded1405"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ffab44db3e239925cda2c1c51bc20ee6d91ea5c6f433b3109ed80a44b375d1b3"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/24240aa08a67aa7823861be40afd5aeb45aec9e0f99b6109658de0d9c716d263"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7487873e11d96defb6910f900f6309d6fbebee14c9f3f47393a09a0a591f20a4"}
{"level":"info","ts":"2026-07-24T04:06:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dc7289156e89bc50d9d09eaf1e297757fff8055d417ffa0af60f8d4d2f351806"}
{"level":"info","ts":"2026-07-24T04:06:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/38fb50e4e0ae72e675f545c5fbd4327fd369d2aa371bdc4644c5ff6790ffdc2e"}
{"level":"info","ts":"2026-07-24T04:06:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e41168d042e99f82af8dbaa62f823e13e38ddf8fa442f085f0a015d34f3bad97"}
{"level":"info","ts":"2026-07-24T04:06:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/943c1a76f8e0cf531ddc3a126e165426eddb687898b077db6d73f3b1bcf99fe1"}
{"level":"info","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:58494","PortSpecifier":{"PortValue":58494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:58494","PortSpecifier":{"PortValue":58494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784866047,"nanos":195861186},"http":{"id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","method":"POST","headers":{":authority":"maas.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9523052d-992f-40d0-a8e6-47495ccf8da0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fe0e81c1-59f4-4fa9-bf87-1a985833e60b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e3741adc75f3"]}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e3741adc75f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fe0e81c1-59f4-4fa9-bf87-1a985833e60b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9523052d-992f-40d0-a8e6-47495ccf8da0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"75d98ccf-5a84-42de-a103-7bba55e4a8e7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:58506","PortSpecifier":{"PortValue":58506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:58506","PortSpecifier":{"PortValue":58506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784866047,"nanos":251703954},"http":{"id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","method":"POST","headers":{":authority":"maas.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Db1unANhSVAcSuH5_EeyETdZGIQzIsdAXIynbZ51RaaHkZErZOpZ1MWXELef"}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Db1unANhSVAcSuH5_EeyETdZGIQzIsdAXIynbZ51RaaHkZErZOpZ1MWXELef\"}"}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"21fad62b-b3db-40e3-b7cb-980bb291e37b","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"21fad62b-b3db-40e3-b7cb-980bb291e37b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"21fad62b-b3db-40e3-b7cb-980bb291e37b","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:07:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77d1c1d6-455b-4214-98ac-ca3d493bbcb0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752"}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752"}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dac268810dbe8e01249f44246cb22b1a89c5f3a9db93851732e272edf1f59d1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752"}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dac268810dbe8e01249f44246cb22b1a89c5f3a9db93851732e272edf1f59d1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dac268810dbe8e01249f44246cb22b1a89c5f3a9db93851732e272edf1f59d1"}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dac268810dbe8e01249f44246cb22b1a89c5f3a9db93851732e272edf1f59d1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dac268810dbe8e01249f44246cb22b1a89c5f3a9db93851732e272edf1f59d1"}
{"level":"info","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dac268810dbe8e01249f44246cb22b1a89c5f3a9db93851732e272edf1f59d1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:56Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d79893a92865aceef062c77349b7633a59e64ef35735194675f82be4ac913bc1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d79893a92865aceef062c77349b7633a59e64ef35735194675f82be4ac913bc1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dac268810dbe8e01249f44246cb22b1a89c5f3a9db93851732e272edf1f59d1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8dac268810dbe8e01249f44246cb22b1a89c5f3a9db93851732e272edf1f59d1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dac268810dbe8e01249f44246cb22b1a89c5f3a9db93851732e272edf1f59d1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d79893a92865aceef062c77349b7633a59e64ef35735194675f82be4ac913bc1"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dac268810dbe8e01249f44246cb22b1a89c5f3a9db93851732e272edf1f59d1"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d79893a92865aceef062c77349b7633a59e64ef35735194675f82be4ac913bc1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d79893a92865aceef062c77349b7633a59e64ef35735194675f82be4ac913bc1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d79893a92865aceef062c77349b7633a59e64ef35735194675f82be4ac913bc1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dac268810dbe8e01249f44246cb22b1a89c5f3a9db93851732e272edf1f59d1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93fe3110404c2198dee30cef8aad61282abcbc01de0446ee969ebf146e9de37a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"93fe3110404c2198dee30cef8aad61282abcbc01de0446ee969ebf146e9de37a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d79893a92865aceef062c77349b7633a59e64ef35735194675f82be4ac913bc1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93fe3110404c2198dee30cef8aad61282abcbc01de0446ee969ebf146e9de37a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752"}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93fe3110404c2198dee30cef8aad61282abcbc01de0446ee969ebf146e9de37a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d79893a92865aceef062c77349b7633a59e64ef35735194675f82be4ac913bc1"}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93fe3110404c2198dee30cef8aad61282abcbc01de0446ee969ebf146e9de37a"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93fe3110404c2198dee30cef8aad61282abcbc01de0446ee969ebf146e9de37a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["93fe3110404c2198dee30cef8aad61282abcbc01de0446ee969ebf146e9de37a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"93fe3110404c2198dee30cef8aad61282abcbc01de0446ee969ebf146e9de37a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93fe3110404c2198dee30cef8aad61282abcbc01de0446ee969ebf146e9de37a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752"}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93fe3110404c2198dee30cef8aad61282abcbc01de0446ee969ebf146e9de37a"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64"}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac"}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b"}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77616bb511a8c158764bf939ffa67064ec6cd0e9654cb96064087a83f3b9cb63","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77616bb511a8c158764bf939ffa67064ec6cd0e9654cb96064087a83f3b9cb63"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77616bb511a8c158764bf939ffa67064ec6cd0e9654cb96064087a83f3b9cb63","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d96cea128fbe098cbe440b335a5298f75147de7f76b7c503c09ec1dfee19bef5"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d96cea128fbe098cbe440b335a5298f75147de7f76b7c503c09ec1dfee19bef5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d96cea128fbe098cbe440b335a5298f75147de7f76b7c503c09ec1dfee19bef5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77616bb511a8c158764bf939ffa67064ec6cd0e9654cb96064087a83f3b9cb63"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d96cea128fbe098cbe440b335a5298f75147de7f76b7c503c09ec1dfee19bef5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77616bb511a8c158764bf939ffa67064ec6cd0e9654cb96064087a83f3b9cb63","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["77616bb511a8c158764bf939ffa67064ec6cd0e9654cb96064087a83f3b9cb63"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d96cea128fbe098cbe440b335a5298f75147de7f76b7c503c09ec1dfee19bef5"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77616bb511a8c158764bf939ffa67064ec6cd0e9654cb96064087a83f3b9cb63","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77616bb511a8c158764bf939ffa67064ec6cd0e9654cb96064087a83f3b9cb63"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d96cea128fbe098cbe440b335a5298f75147de7f76b7c503c09ec1dfee19bef5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77616bb511a8c158764bf939ffa67064ec6cd0e9654cb96064087a83f3b9cb63","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"info","ts":"2026-07-24T04:07:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"debug","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T04:07:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T04:07:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"info","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"info","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T04:07:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T04:07:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"error","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T04:07:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:51836","PortSpecifier":{"PortValue":51836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-733dde.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:51836","PortSpecifier":{"PortValue":51836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784866083,"nanos":915320956},"http":{"id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","method":"POST","headers":{":authority":"e2e-ipp-a-733dde.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9523052d-992f-40d0-a8e6-47495ccf8da0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fe0e81c1-59f4-4fa9-bf87-1a985833e60b"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e3741adc75f3"]}}
{"level":"debug","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e3741adc75f3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fe0e81c1-59f4-4fa9-bf87-1a985833e60b"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9523052d-992f-40d0-a8e6-47495ccf8da0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.73:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-733dde.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-733dde/ipp-route-733dde\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-733dde/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:08:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a072ad1-1f51-47c3-8668-80ab2d0d4595","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:51852","PortSpecifier":{"PortValue":51852}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","method":"POST","path":"/ai-tenant-e2e-ipp-a-733dde/ipp-route-733dde/v1/chat/completions","host":"e2e-ipp-a-733dde.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.13:51852","PortSpecifier":{"PortValue":51852}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784866085,"nanos":985016285},"http":{"id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","method":"POST","headers":{":authority":"e2e-ipp-a-733dde.apps.b3fca911-f795-43a0-91ab-e3741adc75f3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-733dde/ipp-route-733dde/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6GrEZbdEm8GKRHSS_c88JXvTCDFJ5gz93uI7kaLP7nIwXoEsv2zxyUarQfA3"}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-733dde.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6GrEZbdEm8GKRHSS_c88JXvTCDFJ5gz93uI7kaLP7nIwXoEsv2zxyUarQfA3\"}"}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-733dde.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0229d63c-ebbf-4adc-988b-c50a4225420a","keyName":"e2e-ipp-733dde","subscription":"ipp-route-733dde-sub","tenant":"e2e-ipp-a-733dde","userId":"0229d63c-ebbf-4adc-988b-c50a4225420a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-733dde.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-733dde/ipp-route-733dde\",\"requestedSubscription\":\"ipp-route-733dde-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-733dde.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"ipp-route-733dde","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-733dde-sub","namespace":"ai-tenant-e2e-ipp-a-733dde","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-733dde/ipp-route-733dde"}}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-733dde/ipp-route-733dde\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-733dde/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-733dde-sub"}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0229d63c-ebbf-4adc-988b-c50a4225420a","keyName":"e2e-ipp-733dde","selected_subscription":"ipp-route-733dde-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-733dde/ipp-route-733dde-sub@ai-tenant-e2e-ipp-a-733dde/ipp-route-733dde","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"ipp-route-733dde","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-733dde-sub","namespace":"ai-tenant-e2e-ipp-a-733dde","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-733dde/ipp-route-733dde"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T04:08:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f44bf6d4-702e-4701-953b-72ae6e5744ee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T04:09:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fc4b913f7be7ac7bd340399a3f677f2d3acd56ec7e5d3859929d8af05d592396"}
{"level":"info","ts":"2026-07-24T04:09:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/72f66f3723ede3596ca08f9d28cd56a49869b1ba55cc50668e6a93765c0f8eac"}
{"level":"info","ts":"2026-07-24T04:09:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/88216b3c7b3afbb7ca106811b69bb9a9e6780534efa1859fdedb56fa32c31b5b"}
{"level":"info","ts":"2026-07-24T04:09:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d79893a92865aceef062c77349b7633a59e64ef35735194675f82be4ac913bc1"}
{"level":"info","ts":"2026-07-24T04:09:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fae980c24be80f75369da9dc066a036a98804b4b4511701845de6fbcf2cb4d64"}
{"level":"info","ts":"2026-07-24T04:09:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/93fe3110404c2198dee30cef8aad61282abcbc01de0446ee969ebf146e9de37a"}
{"level":"info","ts":"2026-07-24T04:09:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ac7d9622eb56da8c62aa0521679890f482f2c9f6044674b283f080ccc534e60b"}
{"level":"info","ts":"2026-07-24T04:09:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8dac268810dbe8e01249f44246cb22b1a89c5f3a9db93851732e272edf1f59d1"}
{"level":"info","ts":"2026-07-24T04:09:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/77616bb511a8c158764bf939ffa67064ec6cd0e9654cb96064087a83f3b9cb63"}
{"level":"info","ts":"2026-07-24T04:09:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d96cea128fbe098cbe440b335a5298f75147de7f76b7c503c09ec1dfee19bef5"}
{"level":"info","ts":"2026-07-24T04:09:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/84cc5c125b0ef06e64e16a07081e6beda59f370880aef442b6218dfda039b752"}
{"level":"info","ts":"2026-07-24T04:09:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/607988c6466086a2632f3d8541869db7d7c373abbd34e5b543800c1d7d7a45eb"}