{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1fe30440b4a926b949a33b6007d4cec2d994c279ac7f42759dc9c2e85b0a1d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1fe30440b4a926b949a33b6007d4cec2d994c279ac7f42759dc9c2e85b0a1d2"}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657"}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429"}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657"}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47ad3774a602acc8a40a55489189ed55c7f5956f4cfd387919d273d5d5532d5d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47ad3774a602acc8a40a55489189ed55c7f5956f4cfd387919d273d5d5532d5d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47ad3774a602acc8a40a55489189ed55c7f5956f4cfd387919d273d5d5532d5d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47ad3774a602acc8a40a55489189ed55c7f5956f4cfd387919d273d5d5532d5d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47ad3774a602acc8a40a55489189ed55c7f5956f4cfd387919d273d5d5532d5d"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47ad3774a602acc8a40a55489189ed55c7f5956f4cfd387919d273d5d5532d5d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["47ad3774a602acc8a40a55489189ed55c7f5956f4cfd387919d273d5d5532d5d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47ad3774a602acc8a40a55489189ed55c7f5956f4cfd387919d273d5d5532d5d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47ad3774a602acc8a40a55489189ed55c7f5956f4cfd387919d273d5d5532d5d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9474cc95df251c8b3c305302de4d2024dd9c1434563334fc34247b9c8646c72","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47ad3774a602acc8a40a55489189ed55c7f5956f4cfd387919d273d5d5532d5d"}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9474cc95df251c8b3c305302de4d2024dd9c1434563334fc34247b9c8646c72"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"783ee26b47117cd44e5d7f649abcc2651ef31f5fa04398ede3cfce26d1ee6b45","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975"}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/783ee26b47117cd44e5d7f649abcc2651ef31f5fa04398ede3cfce26d1ee6b45"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77f5801c26f1e689b523dd08cf3f53a4887d0e96059aa1669a404348fe681512","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f3c61c4c0f0d6704c01e888e10791b1aff10356f75315b704883d7942e755a5d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77f5801c26f1e689b523dd08cf3f53a4887d0e96059aa1669a404348fe681512"}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"441f1eecd78b6f2b4e497ef1de8b12d979adb0ae8deffc62aac5f197e49b406e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01"}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ae4a39bcc6226a82c234d772f432c5f8dba4a97f719d765d5ddd0fd8c51eabc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ea97d2c76cbad8ba399d24a059046bf8b25b58d2c0666f897518b3f50c6f430a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f3c61c4c0f0d6704c01e888e10791b1aff10356f75315b704883d7942e755a5d"}
{"level":"error","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"08a65cacbe7409aaa30eb58d8c32b7369c4e5f84e46631cd04b020443b1ea667","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/441f1eecd78b6f2b4e497ef1de8b12d979adb0ae8deffc62aac5f197e49b406e"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fbd908170b96078b771765a1f94c26d0bdb4fd7fd2bbaef46ba6d16e3409495","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ae4a39bcc6226a82c234d772f432c5f8dba4a97f719d765d5ddd0fd8c51eabc"}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01"}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ea97d2c76cbad8ba399d24a059046bf8b25b58d2c0666f897518b3f50c6f430a"}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/08a65cacbe7409aaa30eb58d8c32b7369c4e5f84e46631cd04b020443b1ea667"}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fbd908170b96078b771765a1f94c26d0bdb4fd7fd2bbaef46ba6d16e3409495"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1827cf106f0ff5f62179989702550613e329a56954342ce67c6133f0d8a2463","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1827cf106f0ff5f62179989702550613e329a56954342ce67c6133f0d8a2463"}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc"}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f94c1536ef326b93dd280e3e86024550e9ca09b34a420c338eab06270e155e0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34ff48d6bba5894bf675ad689e75bcccdcd9480fe5714d09df3a310d68d5deaa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f94c1536ef326b93dd280e3e86024550e9ca09b34a420c338eab06270e155e0"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34ff48d6bba5894bf675ad689e75bcccdcd9480fe5714d09df3a310d68d5deaa"}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1f0b4c2d4d51da0c84902746e8e5535f9558c9e1c6d88f0853c6da9239697277","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1f0b4c2d4d51da0c84902746e8e5535f9558c9e1c6d88f0853c6da9239697277","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ff490e69bb929b16145cff5632627548bfb718efdb9d23f45694670c61e63e02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1f0b4c2d4d51da0c84902746e8e5535f9558c9e1c6d88f0853c6da9239697277","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1f0b4c2d4d51da0c84902746e8e5535f9558c9e1c6d88f0853c6da9239697277"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1f0b4c2d4d51da0c84902746e8e5535f9558c9e1c6d88f0853c6da9239697277","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T18:17:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1f0b4c2d4d51da0c84902746e8e5535f9558c9e1c6d88f0853c6da9239697277"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1f0b4c2d4d51da0c84902746e8e5535f9558c9e1c6d88f0853c6da9239697277","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1f0b4c2d4d51da0c84902746e8e5535f9558c9e1c6d88f0853c6da9239697277","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42a470b687dc1898223dd8a08be52a0f599f2f887c746ae9901afd0d75e4fa39","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ff490e69bb929b16145cff5632627548bfb718efdb9d23f45694670c61e63e02"}
{"level":"debug","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"736defea492acf2aa4f022c94d360a42f8a0c1ce1b7a75d0634c3d181b78624b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T18:17:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1f0b4c2d4d51da0c84902746e8e5535f9558c9e1c6d88f0853c6da9239697277"}
{"level":"info","ts":"2026-07-13T18:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42a470b687dc1898223dd8a08be52a0f599f2f887c746ae9901afd0d75e4fa39"}
{"level":"info","ts":"2026-07-13T18:17:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/736defea492acf2aa4f022c94d360a42f8a0c1ce1b7a75d0634c3d181b78624b"}
{"level":"info","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:35046","PortSpecifier":{"PortValue":35046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a749de2f-489b-4d7f-b237-46198fb6ae27","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:35046","PortSpecifier":{"PortValue":35046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966651,"nanos":489911923},"http":{"id":"a749de2f-489b-4d7f-b237-46198fb6ae27","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"bc073676-6518-4ce4-a858-0a0540f9f078","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7f1a53c9-afa6-4c46-b7a0-ac94930fe579"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/81c9a1b5e201"]}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/81c9a1b5e201"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7f1a53c9-afa6-4c46-b7a0-ac94930fe579"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"bc073676-6518-4ce4-a858-0a0540f9f078","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c1827cf106f0ff5f62179989702550613e329a56954342ce67c6133f0d8a2463"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a749de2f-489b-4d7f-b237-46198fb6ae27","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55614","PortSpecifier":{"PortValue":55614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"94079c2f-82bc-457e-9308-d31b2f4f683f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-762866.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55614","PortSpecifier":{"PortValue":55614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966651,"nanos":534349252},"http":{"id":"94079c2f-82bc-457e-9308-d31b2f4f683f","method":"POST","headers":{":authority":"e2e-shared-b-762866.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"bc073676-6518-4ce4-a858-0a0540f9f078","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7f1a53c9-afa6-4c46-b7a0-ac94930fe579"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/81c9a1b5e201"]}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/81c9a1b5e201"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7f1a53c9-afa6-4c46-b7a0-ac94930fe579"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"bc073676-6518-4ce4-a858-0a0540f9f078","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ea97d2c76cbad8ba399d24a059046bf8b25b58d2c0666f897518b3f50c6f430a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.56:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-762866.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-762866/rate-test-model-762866\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94079c2f-82bc-457e-9308-d31b2f4f683f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:35062","PortSpecifier":{"PortValue":35062}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:35062","PortSpecifier":{"PortValue":35062}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966651,"nanos":578040761},"http":{"id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14u3kZZm4KkIojGZW_SaPv8RSKH3UFBMedeaGGD6f1UGNPtABv2pnVd9yPByE"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14u3kZZm4KkIojGZW_SaPv8RSKH3UFBMedeaGGD6f1UGNPtABv2pnVd9yPByE\"}"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"623b1746-3fbc-4102-8047-1a4d7d1365ec","keyName":"e2e-rate-a-434aca","subscription":"e2e-rate-iso-a-434aca","tenant":"e2e-shared-a-a74fcd","userId":"623b1746-3fbc-4102-8047-1a4d7d1365ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-434aca\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-434aca","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-434aca"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"623b1746-3fbc-4102-8047-1a4d7d1365ec","keyName":"e2e-rate-a-434aca","selected_subscription":"e2e-rate-iso-a-434aca","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-434aca@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-434aca","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce3005eb-2fc8-41cf-b180-07ba8c7c37d3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:37598","PortSpecifier":{"PortValue":37598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:37598","PortSpecifier":{"PortValue":37598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966652,"nanos":642991603},"http":{"id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14u3kZZm4KkIojGZW_SaPv8RSKH3UFBMedeaGGD6f1UGNPtABv2pnVd9yPByE"}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14u3kZZm4KkIojGZW_SaPv8RSKH3UFBMedeaGGD6f1UGNPtABv2pnVd9yPByE\"}"}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"623b1746-3fbc-4102-8047-1a4d7d1365ec","keyName":"e2e-rate-a-434aca","subscription":"e2e-rate-iso-a-434aca","tenant":"e2e-shared-a-a74fcd","userId":"623b1746-3fbc-4102-8047-1a4d7d1365ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-434aca\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-434aca","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-434aca"}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"623b1746-3fbc-4102-8047-1a4d7d1365ec","keyName":"e2e-rate-a-434aca","selected_subscription":"e2e-rate-iso-a-434aca","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-434aca@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-434aca","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4266f40f-6e6b-45c3-8257-9e0a62007b42","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:37608","PortSpecifier":{"PortValue":37608}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cecc254b-6b32-4d6c-a415-968c30ad442f","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:37608","PortSpecifier":{"PortValue":37608}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966653,"nanos":687137865},"http":{"id":"cecc254b-6b32-4d6c-a415-968c30ad442f","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14u3kZZm4KkIojGZW_SaPv8RSKH3UFBMedeaGGD6f1UGNPtABv2pnVd9yPByE"}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14u3kZZm4KkIojGZW_SaPv8RSKH3UFBMedeaGGD6f1UGNPtABv2pnVd9yPByE\"}"}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"623b1746-3fbc-4102-8047-1a4d7d1365ec","keyName":"e2e-rate-a-434aca","subscription":"e2e-rate-iso-a-434aca","tenant":"e2e-shared-a-a74fcd","userId":"623b1746-3fbc-4102-8047-1a4d7d1365ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-434aca\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-434aca","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-434aca"}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"623b1746-3fbc-4102-8047-1a4d7d1365ec","keyName":"e2e-rate-a-434aca","selected_subscription":"e2e-rate-iso-a-434aca","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-434aca@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-434aca","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cecc254b-6b32-4d6c-a415-968c30ad442f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40234","PortSpecifier":{"PortValue":40234}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40234","PortSpecifier":{"PortValue":40234}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966662,"nanos":707608989},"http":{"id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"bc073676-6518-4ce4-a858-0a0540f9f078","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7f1a53c9-afa6-4c46-b7a0-ac94930fe579"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/81c9a1b5e201"]}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/81c9a1b5e201"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7f1a53c9-afa6-4c46-b7a0-ac94930fe579"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"bc073676-6518-4ce4-a858-0a0540f9f078","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c1827cf106f0ff5f62179989702550613e329a56954342ce67c6133f0d8a2463"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a73ea83c-5c6c-4c53-8d10-8e0641993f53","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46c48579-507c-42fb-8f07-6218b27ee584","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55186","PortSpecifier":{"PortValue":55186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"46c48579-507c-42fb-8f07-6218b27ee584","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-762866.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46c48579-507c-42fb-8f07-6218b27ee584","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55186","PortSpecifier":{"PortValue":55186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966662,"nanos":748573730},"http":{"id":"46c48579-507c-42fb-8f07-6218b27ee584","method":"POST","headers":{":authority":"e2e-shared-b-762866.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"46c48579-507c-42fb-8f07-6218b27ee584","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"46c48579-507c-42fb-8f07-6218b27ee584","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"bc073676-6518-4ce4-a858-0a0540f9f078","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7f1a53c9-afa6-4c46-b7a0-ac94930fe579"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/81c9a1b5e201"]}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"46c48579-507c-42fb-8f07-6218b27ee584","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/81c9a1b5e201"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7f1a53c9-afa6-4c46-b7a0-ac94930fe579"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"bc073676-6518-4ce4-a858-0a0540f9f078","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ea97d2c76cbad8ba399d24a059046bf8b25b58d2c0666f897518b3f50c6f430a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.56:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-762866.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46c48579-507c-42fb-8f07-6218b27ee584","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46c48579-507c-42fb-8f07-6218b27ee584","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46c48579-507c-42fb-8f07-6218b27ee584","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-762866/rate-test-model-762866\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"46c48579-507c-42fb-8f07-6218b27ee584","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46c48579-507c-42fb-8f07-6218b27ee584","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46c48579-507c-42fb-8f07-6218b27ee584","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46c48579-507c-42fb-8f07-6218b27ee584","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46c48579-507c-42fb-8f07-6218b27ee584","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40240","PortSpecifier":{"PortValue":40240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d47b493c-5655-4ab7-84d0-25bfa3754508","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40240","PortSpecifier":{"PortValue":40240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966662,"nanos":795959674},"http":{"id":"d47b493c-5655-4ab7-84d0-25bfa3754508","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS\"}"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","subscription":"e2e-rate-iso-a-262c1c","tenant":"e2e-shared-a-a74fcd","userId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-262c1c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-262c1c"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","selected_subscription":"e2e-rate-iso-a-262c1c","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-262c1c@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d47b493c-5655-4ab7-84d0-25bfa3754508","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40256","PortSpecifier":{"PortValue":40256}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40256","PortSpecifier":{"PortValue":40256}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966663,"nanos":833595675},"http":{"id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS"}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS\"}"}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","subscription":"e2e-rate-iso-a-262c1c","tenant":"e2e-shared-a-a74fcd","userId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-262c1c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-262c1c"}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","selected_subscription":"e2e-rate-iso-a-262c1c","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-262c1c@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8f07236e-2deb-48c1-a8ec-c655d65ece8e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40270","PortSpecifier":{"PortValue":40270}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40270","PortSpecifier":{"PortValue":40270}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966664,"nanos":872780574},"http":{"id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS"}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS\"}"}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","subscription":"e2e-rate-iso-a-262c1c","tenant":"e2e-shared-a-a74fcd","userId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-262c1c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-262c1c"}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","selected_subscription":"e2e-rate-iso-a-262c1c","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-262c1c@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9ef7c07-f912-4622-b8fa-5c7eb1e9c47c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40282","PortSpecifier":{"PortValue":40282}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40282","PortSpecifier":{"PortValue":40282}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966665,"nanos":913126494},"http":{"id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS"}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS\"}"}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","subscription":"e2e-rate-iso-a-262c1c","tenant":"e2e-shared-a-a74fcd","userId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-262c1c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-262c1c"}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","selected_subscription":"e2e-rate-iso-a-262c1c","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-262c1c@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"28a2e9a8-0cba-460b-996b-a7f8c2aa19f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40286","PortSpecifier":{"PortValue":40286}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ff550700-944f-4639-8b3e-c34cc05d0792","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40286","PortSpecifier":{"PortValue":40286}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966666,"nanos":956055928},"http":{"id":"ff550700-944f-4639-8b3e-c34cc05d0792","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS"}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS\"}"}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","subscription":"e2e-rate-iso-a-262c1c","tenant":"e2e-shared-a-a74fcd","userId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-262c1c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-262c1c"}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","selected_subscription":"e2e-rate-iso-a-262c1c","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-262c1c@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff550700-944f-4639-8b3e-c34cc05d0792","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40302","PortSpecifier":{"PortValue":40302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40302","PortSpecifier":{"PortValue":40302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966667,"nanos":995510070},"http":{"id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS"}
{"level":"debug","ts":"2026-07-13T18:17:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS\"}"}
{"level":"debug","ts":"2026-07-13T18:17:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","subscription":"e2e-rate-iso-a-262c1c","tenant":"e2e-shared-a-a74fcd","userId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-262c1c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-262c1c"}
{"level":"debug","ts":"2026-07-13T18:17:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","selected_subscription":"e2e-rate-iso-a-262c1c","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-262c1c@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8dcbfea0-9c40-416c-87ef-d0cebd85f8bf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40314","PortSpecifier":{"PortValue":40314}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40314","PortSpecifier":{"PortValue":40314}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966669,"nanos":37100617},"http":{"id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS"}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS\"}"}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","subscription":"e2e-rate-iso-a-262c1c","tenant":"e2e-shared-a-a74fcd","userId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-262c1c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-262c1c"}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","selected_subscription":"e2e-rate-iso-a-262c1c","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-262c1c@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6f52980-e90a-499b-8d77-38bcf84ae3fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40326","PortSpecifier":{"PortValue":40326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40326","PortSpecifier":{"PortValue":40326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966670,"nanos":79394891},"http":{"id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS"}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS\"}"}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","subscription":"e2e-rate-iso-a-262c1c","tenant":"e2e-shared-a-a74fcd","userId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-262c1c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-262c1c"}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","selected_subscription":"e2e-rate-iso-a-262c1c","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-262c1c@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be15188f-1962-4fd9-8ff4-f4cdc68178f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40332","PortSpecifier":{"PortValue":40332}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40332","PortSpecifier":{"PortValue":40332}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966671,"nanos":118661098},"http":{"id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS"}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS\"}"}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","subscription":"e2e-rate-iso-a-262c1c","tenant":"e2e-shared-a-a74fcd","userId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-262c1c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-262c1c"}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","selected_subscription":"e2e-rate-iso-a-262c1c","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-262c1c@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ead19a9f-015a-4fe4-b305-f28f21ba0c2a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40338","PortSpecifier":{"PortValue":40338}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","method":"POST","path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions","host":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:40338","PortSpecifier":{"PortValue":40338}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966672,"nanos":162374807},"http":{"id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","method":"POST","headers":{":authority":"e2e-shared-a-a74fcd.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-idgkty9RitkcrlEu_my9Vq4F6y66mbMPA9XZTxw8giUZbnmyF0w4qivWZxzS\"}"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","subscription":"e2e-rate-iso-a-262c1c","tenant":"e2e-shared-a-a74fcd","userId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\",\"requestedSubscription\":\"e2e-rate-iso-a-262c1c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-a74fcd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-262c1c"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"69ad0972-7d61-4b80-88c0-74292b45ea6e","keyName":"e2e-rate-a-262c1c","selected_subscription":"e2e-rate-iso-a-262c1c","selected_subscription_key":"ai-tenant-e2e-shared-a-a74fcd/e2e-rate-iso-a-262c1c@ai-tenant-e2e-shared-a-a74fcd/rate-test-model-a74fcd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a74fcd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-262c1c","namespace":"ai-tenant-e2e-shared-a-a74fcd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74fe4a1b-b87e-4214-9a76-f4a3960c992a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55190","PortSpecifier":{"PortValue":55190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","method":"POST","path":"/ai-tenant-e2e-shared-b-762866/rate-test-model-762866/v1/completions","host":"e2e-shared-b-762866.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.17:55190","PortSpecifier":{"PortValue":55190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783966672,"nanos":202692476},"http":{"id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","method":"POST","headers":{":authority":"e2e-shared-b-762866.apps.faea9a92-7c33-4c62-a7ed-81c9a1b5e201.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-762866/rate-test-model-762866/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UG3RCRNQl1FWSzId_SW2wSaYDgtiJn9R1sw0LIQUbTzski5RpuDa7wNobD9G"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-762866.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UG3RCRNQl1FWSzId_SW2wSaYDgtiJn9R1sw0LIQUbTzski5RpuDa7wNobD9G\"}"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-762866.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dd8930cf-da5d-48b4-81f3-0cc44c2f6efc","keyName":"e2e-rate-b-262c1c","subscription":"e2e-rate-iso-b-262c1c","tenant":"e2e-shared-b-762866","userId":"dd8930cf-da5d-48b4-81f3-0cc44c2f6efc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-762866.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-762866/rate-test-model-762866\",\"requestedSubscription\":\"e2e-rate-iso-b-262c1c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-762866.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-762866","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-262c1c","namespace":"ai-tenant-e2e-shared-b-762866","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-762866/rate-test-model-762866\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-262c1c"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dd8930cf-da5d-48b4-81f3-0cc44c2f6efc","keyName":"e2e-rate-b-262c1c","selected_subscription":"e2e-rate-iso-b-262c1c","selected_subscription_key":"ai-tenant-e2e-shared-b-762866/e2e-rate-iso-b-262c1c@ai-tenant-e2e-shared-b-762866/rate-test-model-762866","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-762866","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-262c1c","namespace":"ai-tenant-e2e-shared-b-762866","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T18:17:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5d3e2fc-1e25-4233-8146-7273ea3ca1b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T18:17:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/441f1eecd78b6f2b4e497ef1de8b12d979adb0ae8deffc62aac5f197e49b406e"}
{"level":"info","ts":"2026-07-13T18:17:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/736defea492acf2aa4f022c94d360a42f8a0c1ce1b7a75d0634c3d181b78624b"}
{"level":"info","ts":"2026-07-13T18:17:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/26f9e744f0a34c9e8de07b39a7715a9bcd5ab6703734492be0c905edb0a7f657"}
{"level":"info","ts":"2026-07-13T18:17:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/47ad3774a602acc8a40a55489189ed55c7f5956f4cfd387919d273d5d5532d5d"}
{"level":"info","ts":"2026-07-13T18:17:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/34ff48d6bba5894bf675ad689e75bcccdcd9480fe5714d09df3a310d68d5deaa"}
{"level":"info","ts":"2026-07-13T18:17:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/77f5801c26f1e689b523dd08cf3f53a4887d0e96059aa1669a404348fe681512"}
{"level":"info","ts":"2026-07-13T18:17:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4fbd908170b96078b771765a1f94c26d0bdb4fd7fd2bbaef46ba6d16e3409495"}
{"level":"info","ts":"2026-07-13T18:18:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a0b71c83ded2af3fb06e02d3aac3d32f3d18f203c2b6df96d7a1c3174866b975"}
{"level":"info","ts":"2026-07-13T18:18:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dbd7ad6976f7af84af003e4bb8c5f6ae8f530d8fe09ddd0386f3dabc65421c01"}
{"level":"info","ts":"2026-07-13T18:18:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f3c61c4c0f0d6704c01e888e10791b1aff10356f75315b704883d7942e755a5d"}
{"level":"info","ts":"2026-07-13T18:18:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e9474cc95df251c8b3c305302de4d2024dd9c1434563334fc34247b9c8646c72"}
{"level":"info","ts":"2026-07-13T18:18:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/783ee26b47117cd44e5d7f649abcc2651ef31f5fa04398ede3cfce26d1ee6b45"}
{"level":"info","ts":"2026-07-13T18:18:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9c34b2bd75f4e9646908d5813ca20909a4ac10d79bb729207d83475c44b5e429"}
{"level":"info","ts":"2026-07-13T18:18:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1f0b4c2d4d51da0c84902746e8e5535f9558c9e1c6d88f0853c6da9239697277"}
{"level":"info","ts":"2026-07-13T18:18:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/47b4bacdf9f90ef2901d9bc574950848606b35cff4c4bc9482542157afd8ffcc"}
{"level":"info","ts":"2026-07-13T18:18:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c1fe30440b4a926b949a33b6007d4cec2d994c279ac7f42759dc9c2e85b0a1d2"}
{"level":"info","ts":"2026-07-13T18:18:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/42a470b687dc1898223dd8a08be52a0f599f2f887c746ae9901afd0d75e4fa39"}
{"level":"info","ts":"2026-07-13T18:18:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3f94c1536ef326b93dd280e3e86024550e9ca09b34a420c338eab06270e155e0"}
{"level":"info","ts":"2026-07-13T18:18:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c1827cf106f0ff5f62179989702550613e329a56954342ce67c6133f0d8a2463"}
{"level":"info","ts":"2026-07-13T18:18:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/07ca0e9716415bd7aa98174bdeca7dd87d4387330e86bd215001dce3aec8e76b"}
{"level":"info","ts":"2026-07-13T18:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ff490e69bb929b16145cff5632627548bfb718efdb9d23f45694670c61e63e02"}
{"level":"info","ts":"2026-07-13T18:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ae4a39bcc6226a82c234d772f432c5f8dba4a97f719d765d5ddd0fd8c51eabc"}
{"level":"info","ts":"2026-07-13T18:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ea97d2c76cbad8ba399d24a059046bf8b25b58d2c0666f897518b3f50c6f430a"}
{"level":"info","ts":"2026-07-13T18:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/08a65cacbe7409aaa30eb58d8c32b7369c4e5f84e46631cd04b020443b1ea667"}