{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e93aa20cf59e8c3f6497da361fa1bc4bc7aa89c9f1ddd967bf34bf59f380492","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e93aa20cf59e8c3f6497da361fa1bc4bc7aa89c9f1ddd967bf34bf59f380492"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b2e8667827e8889cc39638a8439f85d43fd8930dc544f13e74d460a2989f36d"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e93aa20cf59e8c3f6497da361fa1bc4bc7aa89c9f1ddd967bf34bf59f380492","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b2e8667827e8889cc39638a8439f85d43fd8930dc544f13e74d460a2989f36d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b2e8667827e8889cc39638a8439f85d43fd8930dc544f13e74d460a2989f36d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e93aa20cf59e8c3f6497da361fa1bc4bc7aa89c9f1ddd967bf34bf59f380492"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b2e8667827e8889cc39638a8439f85d43fd8930dc544f13e74d460a2989f36d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e93aa20cf59e8c3f6497da361fa1bc4bc7aa89c9f1ddd967bf34bf59f380492","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0e93aa20cf59e8c3f6497da361fa1bc4bc7aa89c9f1ddd967bf34bf59f380492"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b2e8667827e8889cc39638a8439f85d43fd8930dc544f13e74d460a2989f36d"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e93aa20cf59e8c3f6497da361fa1bc4bc7aa89c9f1ddd967bf34bf59f380492","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b2e8667827e8889cc39638a8439f85d43fd8930dc544f13e74d460a2989f36d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e93aa20cf59e8c3f6497da361fa1bc4bc7aa89c9f1ddd967bf34bf59f380492"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e93aa20cf59e8c3f6497da361fa1bc4bc7aa89c9f1ddd967bf34bf59f380492","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0"}
{"level":"error","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0"}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5"}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"}
{"level":"debug","ts":"2026-07-07T16:22:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97"}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972"}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97"}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972"}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97"}
{"level":"info","ts":"2026-07-07T16:22:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972"}
{"level":"debug","ts":"2026-07-07T16:22:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6df9cd07ce8afeed7139a025a10cba2e85a3b58fe678d9f5985b42dbe8b03413","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6df9cd07ce8afeed7139a025a10cba2e85a3b58fe678d9f5985b42dbe8b03413"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4"}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b2e8667827e8889cc39638a8439f85d43fd8930dc544f13e74d460a2989f36d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b2e8667827e8889cc39638a8439f85d43fd8930dc544f13e74d460a2989f36d"}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4"}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5"}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22"}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e93aa20cf59e8c3f6497da361fa1bc4bc7aa89c9f1ddd967bf34bf59f380492"}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e93aa20cf59e8c3f6497da361fa1bc4bc7aa89c9f1ddd967bf34bf59f380492","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b5673222e0ee20fb6b9bfc9805c52836835669997c9cd10579c1a699579f9794","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22"}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T16:22:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T16:22:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5"}
{"level":"error","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f5fbf0a8489c0a06af2c3ea5e569414594709ecec73f7d9c1f85aa971fa82474","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b5673222e0ee20fb6b9bfc9805c52836835669997c9cd10579c1a699579f9794"}
{"level":"debug","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da0498e4adfed543512862711c263e1b5a0e8f4b7fff53f96061c81ecf9d4dc2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22"}
{"level":"debug","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a6de20ac261798dcfa45d0e8008a542d133f99066b22846a65e6dfaeeaa6221c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f5fbf0a8489c0a06af2c3ea5e569414594709ecec73f7d9c1f85aa971fa82474"}
{"level":"debug","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc936591b727eed50ee10cdc3ee15d303798ea5dc0359890c887d94c91b1b5b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/da0498e4adfed543512862711c263e1b5a0e8f4b7fff53f96061c81ecf9d4dc2"}
{"level":"debug","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"79371936cd2335651afa1c7a02e264f2b4655284d32e5d33d8fa720a05f092a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6de20ac261798dcfa45d0e8008a542d133f99066b22846a65e6dfaeeaa6221c"}
{"level":"debug","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3600b038a7736a51627ccfbf1a96a2c3d1c3d2e7c4d137c772b236e345bbbcbc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc936591b727eed50ee10cdc3ee15d303798ea5dc0359890c887d94c91b1b5b3"}
{"level":"debug","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/79371936cd2335651afa1c7a02e264f2b4655284d32e5d33d8fa720a05f092a7"}
{"level":"debug","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee0d36db43f379b96fe9c61e2b61a7301e0ccabc8fdac91090d2c1ff57b21f7b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3600b038a7736a51627ccfbf1a96a2c3d1c3d2e7c4d137c772b236e345bbbcbc"}
{"level":"debug","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0"}
{"level":"info","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee0d36db43f379b96fe9c61e2b61a7301e0ccabc8fdac91090d2c1ff57b21f7b"}
{"level":"info","ts":"2026-07-07T16:22:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97"}
{"level":"info","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46390","PortSpecifier":{"PortValue":46390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46390","PortSpecifier":{"PortValue":46390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441375,"nanos":854717505},"http":{"id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"50669605-41c7-4b46-b8b2-5cae8262d39d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99876a64-866e-484e-8efe-91011eab48a8"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/448c2ab40b4c"]}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/448c2ab40b4c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99876a64-866e-484e-8efe-91011eab48a8"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"50669605-41c7-4b46-b8b2-5cae8262d39d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"f5fbf0a8489c0a06af2c3ea5e569414594709ecec73f7d9c1f85aa971fa82474"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.64:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a92eda5-a7a4-4857-a239-108e2fd49a80","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53568","PortSpecifier":{"PortValue":53568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1b158d03-9cc1-4b20-97d5-466da9a24209","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17e556.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53568","PortSpecifier":{"PortValue":53568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441375,"nanos":896484925},"http":{"id":"1b158d03-9cc1-4b20-97d5-466da9a24209","method":"POST","headers":{":authority":"e2e-shared-b-17e556.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"50669605-41c7-4b46-b8b2-5cae8262d39d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99876a64-866e-484e-8efe-91011eab48a8"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/448c2ab40b4c"]}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/448c2ab40b4c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99876a64-866e-484e-8efe-91011eab48a8"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"50669605-41c7-4b46-b8b2-5cae8262d39d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3600b038a7736a51627ccfbf1a96a2c3d1c3d2e7c4d137c772b236e345bbbcbc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.65:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17e556.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17e556/rate-test-model-17e556\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1b158d03-9cc1-4b20-97d5-466da9a24209","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46406","PortSpecifier":{"PortValue":46406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","method":"POST","path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46406","PortSpecifier":{"PortValue":46406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441375,"nanos":935759491},"http":{"id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1O3fshDDLiKAGYzjw_vCLL8aaIsrLD72Ug3fRZlXAt6uqdHaYrgiCNuL6hdiv"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1O3fshDDLiKAGYzjw_vCLL8aaIsrLD72Ug3fRZlXAt6uqdHaYrgiCNuL6hdiv\"}"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2c17ca39-0de3-4597-a2d8-552dc1155cca","keyName":"e2e-rate-a-beb241","subscription":"e2e-rate-iso-a-beb241","tenant":"e2e-shared-a-382396","userId":"2c17ca39-0de3-4597-a2d8-552dc1155cca","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\",\"requestedSubscription\":\"e2e-rate-iso-a-beb241\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-beb241","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-beb241"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2c17ca39-0de3-4597-a2d8-552dc1155cca","keyName":"e2e-rate-a-beb241","selected_subscription":"e2e-rate-iso-a-beb241","selected_subscription_key":"ai-tenant-e2e-shared-a-382396/e2e-rate-iso-a-beb241@ai-tenant-e2e-shared-a-382396/rate-test-model-382396","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-beb241","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:22:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb0d7d40-5dc5-412c-81ef-d8654b039dd4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:22:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46420","PortSpecifier":{"PortValue":46420}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","method":"POST","path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:22:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46420","PortSpecifier":{"PortValue":46420}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441376,"nanos":998781832},"http":{"id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1O3fshDDLiKAGYzjw_vCLL8aaIsrLD72Ug3fRZlXAt6uqdHaYrgiCNuL6hdiv"}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1O3fshDDLiKAGYzjw_vCLL8aaIsrLD72Ug3fRZlXAt6uqdHaYrgiCNuL6hdiv\"}"}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2c17ca39-0de3-4597-a2d8-552dc1155cca","keyName":"e2e-rate-a-beb241","subscription":"e2e-rate-iso-a-beb241","tenant":"e2e-shared-a-382396","userId":"2c17ca39-0de3-4597-a2d8-552dc1155cca","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\",\"requestedSubscription\":\"e2e-rate-iso-a-beb241\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-beb241","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-beb241"}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2c17ca39-0de3-4597-a2d8-552dc1155cca","keyName":"e2e-rate-a-beb241","selected_subscription":"e2e-rate-iso-a-beb241","selected_subscription_key":"ai-tenant-e2e-shared-a-382396/e2e-rate-iso-a-beb241@ai-tenant-e2e-shared-a-382396/rate-test-model-382396","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-beb241","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:22:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"52799444-6c63-4643-9ff3-2a9fa5c2f594","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46426","PortSpecifier":{"PortValue":46426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","method":"POST","path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46426","PortSpecifier":{"PortValue":46426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441378,"nanos":41215402},"http":{"id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1O3fshDDLiKAGYzjw_vCLL8aaIsrLD72Ug3fRZlXAt6uqdHaYrgiCNuL6hdiv"}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1O3fshDDLiKAGYzjw_vCLL8aaIsrLD72Ug3fRZlXAt6uqdHaYrgiCNuL6hdiv\"}"}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2c17ca39-0de3-4597-a2d8-552dc1155cca","keyName":"e2e-rate-a-beb241","subscription":"e2e-rate-iso-a-beb241","tenant":"e2e-shared-a-382396","userId":"2c17ca39-0de3-4597-a2d8-552dc1155cca","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\",\"requestedSubscription\":\"e2e-rate-iso-a-beb241\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-beb241","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-beb241"}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2c17ca39-0de3-4597-a2d8-552dc1155cca","keyName":"e2e-rate-a-beb241","selected_subscription":"e2e-rate-iso-a-beb241","selected_subscription_key":"ai-tenant-e2e-shared-a-382396/e2e-rate-iso-a-beb241@ai-tenant-e2e-shared-a-382396/rate-test-model-382396","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-beb241","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:22:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e48a2ac-855e-4678-837f-4ae6ce58a841","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41216","PortSpecifier":{"PortValue":41216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41216","PortSpecifier":{"PortValue":41216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441393,"nanos":979776026},"http":{"id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"50669605-41c7-4b46-b8b2-5cae8262d39d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99876a64-866e-484e-8efe-91011eab48a8"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/448c2ab40b4c"]}}
{"level":"debug","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/448c2ab40b4c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99876a64-866e-484e-8efe-91011eab48a8"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"50669605-41c7-4b46-b8b2-5cae8262d39d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"f5fbf0a8489c0a06af2c3ea5e569414594709ecec73f7d9c1f85aa971fa82474"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.64:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:23:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b5bd895-d7ee-4cf1-aeda-64733d243899","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:49284","PortSpecifier":{"PortValue":49284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-17e556.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:49284","PortSpecifier":{"PortValue":49284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441394,"nanos":16362256},"http":{"id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","method":"POST","headers":{":authority":"e2e-shared-b-17e556.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"50669605-41c7-4b46-b8b2-5cae8262d39d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99876a64-866e-484e-8efe-91011eab48a8"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/448c2ab40b4c"]}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/448c2ab40b4c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99876a64-866e-484e-8efe-91011eab48a8"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"50669605-41c7-4b46-b8b2-5cae8262d39d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3600b038a7736a51627ccfbf1a96a2c3d1c3d2e7c4d137c772b236e345bbbcbc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.65:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-17e556.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17e556/rate-test-model-17e556\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c1da84c-9bb8-4bf6-96df-14b1d9ed43ff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41222","PortSpecifier":{"PortValue":41222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","method":"POST","path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41222","PortSpecifier":{"PortValue":41222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441394,"nanos":56760709},"http":{"id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l"}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l\"}"}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","subscription":"e2e-rate-iso-a-df747c","tenant":"e2e-shared-a-382396","userId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\",\"requestedSubscription\":\"e2e-rate-iso-a-df747c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-df747c"}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","selected_subscription":"e2e-rate-iso-a-df747c","selected_subscription_key":"ai-tenant-e2e-shared-a-382396/e2e-rate-iso-a-df747c@ai-tenant-e2e-shared-a-382396/rate-test-model-382396","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:23:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b05cee46-2144-43c7-bc05-3c9ee90c8b21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41236","PortSpecifier":{"PortValue":41236}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","method":"POST","path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41236","PortSpecifier":{"PortValue":41236}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441395,"nanos":92986523},"http":{"id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l"}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l\"}"}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","subscription":"e2e-rate-iso-a-df747c","tenant":"e2e-shared-a-382396","userId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\",\"requestedSubscription\":\"e2e-rate-iso-a-df747c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-df747c"}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","selected_subscription":"e2e-rate-iso-a-df747c","selected_subscription_key":"ai-tenant-e2e-shared-a-382396/e2e-rate-iso-a-df747c@ai-tenant-e2e-shared-a-382396/rate-test-model-382396","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:23:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5123cac4-61e5-4787-8e5e-c33dbd930d4b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41240","PortSpecifier":{"PortValue":41240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","method":"POST","path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41240","PortSpecifier":{"PortValue":41240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441396,"nanos":128822332},"http":{"id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l"}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l\"}"}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","subscription":"e2e-rate-iso-a-df747c","tenant":"e2e-shared-a-382396","userId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\",\"requestedSubscription\":\"e2e-rate-iso-a-df747c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-df747c"}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","selected_subscription":"e2e-rate-iso-a-df747c","selected_subscription_key":"ai-tenant-e2e-shared-a-382396/e2e-rate-iso-a-df747c@ai-tenant-e2e-shared-a-382396/rate-test-model-382396","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:23:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"49fdb42e-ffbd-46e8-8a61-0f790e7e4a84","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41252","PortSpecifier":{"PortValue":41252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"545546f2-fe4b-4371-aac6-3eefd16851d0","method":"POST","path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41252","PortSpecifier":{"PortValue":41252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441397,"nanos":168778178},"http":{"id":"545546f2-fe4b-4371-aac6-3eefd16851d0","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l"}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l\"}"}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","subscription":"e2e-rate-iso-a-df747c","tenant":"e2e-shared-a-382396","userId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\",\"requestedSubscription\":\"e2e-rate-iso-a-df747c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-df747c"}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","selected_subscription":"e2e-rate-iso-a-df747c","selected_subscription_key":"ai-tenant-e2e-shared-a-382396/e2e-rate-iso-a-df747c@ai-tenant-e2e-shared-a-382396/rate-test-model-382396","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:23:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"545546f2-fe4b-4371-aac6-3eefd16851d0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41254","PortSpecifier":{"PortValue":41254}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","method":"POST","path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41254","PortSpecifier":{"PortValue":41254}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441398,"nanos":206081049},"http":{"id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l"}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l\"}"}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","subscription":"e2e-rate-iso-a-df747c","tenant":"e2e-shared-a-382396","userId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\",\"requestedSubscription\":\"e2e-rate-iso-a-df747c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-df747c"}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","selected_subscription":"e2e-rate-iso-a-df747c","selected_subscription_key":"ai-tenant-e2e-shared-a-382396/e2e-rate-iso-a-df747c@ai-tenant-e2e-shared-a-382396/rate-test-model-382396","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:23:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca9c1f44-e8ad-4116-86f4-7a8e449f6b78","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41262","PortSpecifier":{"PortValue":41262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","method":"POST","path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41262","PortSpecifier":{"PortValue":41262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441399,"nanos":242635519},"http":{"id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l"}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l\"}"}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","subscription":"e2e-rate-iso-a-df747c","tenant":"e2e-shared-a-382396","userId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\",\"requestedSubscription\":\"e2e-rate-iso-a-df747c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-df747c"}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","selected_subscription":"e2e-rate-iso-a-df747c","selected_subscription_key":"ai-tenant-e2e-shared-a-382396/e2e-rate-iso-a-df747c@ai-tenant-e2e-shared-a-382396/rate-test-model-382396","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:23:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5ee6ef7c-6031-42c7-9cb0-e010515f7ead","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:55522","PortSpecifier":{"PortValue":55522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","method":"POST","path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:55522","PortSpecifier":{"PortValue":55522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441400,"nanos":281405050},"http":{"id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l"}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l\"}"}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","subscription":"e2e-rate-iso-a-df747c","tenant":"e2e-shared-a-382396","userId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\",\"requestedSubscription\":\"e2e-rate-iso-a-df747c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-df747c"}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","selected_subscription":"e2e-rate-iso-a-df747c","selected_subscription_key":"ai-tenant-e2e-shared-a-382396/e2e-rate-iso-a-df747c@ai-tenant-e2e-shared-a-382396/rate-test-model-382396","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:23:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c383b3b1-ada2-4973-8766-ab77f8d22e70","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01360215-10b4-4a69-af3c-823f3d184691","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:55528","PortSpecifier":{"PortValue":55528}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"01360215-10b4-4a69-af3c-823f3d184691","method":"POST","path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions","host":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01360215-10b4-4a69-af3c-823f3d184691","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:55528","PortSpecifier":{"PortValue":55528}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441401,"nanos":316051075},"http":{"id":"01360215-10b4-4a69-af3c-823f3d184691","method":"POST","headers":{":authority":"e2e-shared-a-382396.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-382396/rate-test-model-382396/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Xjz36URzb0ApcmET_lvyM8rFBLVb4Wapk1ZXnGiXwQsBCynMOcwKid7ZEC8l\"}"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","subscription":"e2e-rate-iso-a-df747c","tenant":"e2e-shared-a-382396","userId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\",\"requestedSubscription\":\"e2e-rate-iso-a-df747c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-382396.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"01360215-10b4-4a69-af3c-823f3d184691","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-382396/rate-test-model-382396\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-df747c"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01360215-10b4-4a69-af3c-823f3d184691","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"adfa1ffb-6ef1-4ece-97ef-24b778d9f97a","keyName":"e2e-rate-a-df747c","selected_subscription":"e2e-rate-iso-a-df747c","selected_subscription_key":"ai-tenant-e2e-shared-a-382396/e2e-rate-iso-a-df747c@ai-tenant-e2e-shared-a-382396/rate-test-model-382396","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-382396","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-df747c","namespace":"ai-tenant-e2e-shared-a-382396","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01360215-10b4-4a69-af3c-823f3d184691","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01360215-10b4-4a69-af3c-823f3d184691","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bc396216-2467-440c-8ba8-ca7958393511","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54210","PortSpecifier":{"PortValue":54210}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bc396216-2467-440c-8ba8-ca7958393511","method":"POST","path":"/ai-tenant-e2e-shared-b-17e556/rate-test-model-17e556/v1/completions","host":"e2e-shared-b-17e556.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bc396216-2467-440c-8ba8-ca7958393511","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54210","PortSpecifier":{"PortValue":54210}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783441401,"nanos":351963867},"http":{"id":"bc396216-2467-440c-8ba8-ca7958393511","method":"POST","headers":{":authority":"e2e-shared-b-17e556.apps.16f7e6e2-9f92-415e-a87c-448c2ab40b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-17e556/rate-test-model-17e556/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14aVPHbwSxt9CbNct_wSfr0wqciS0tgUIBqai6mM4GZgwFAFETulOSTgwt7Cq"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-17e556.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14aVPHbwSxt9CbNct_wSfr0wqciS0tgUIBqai6mM4GZgwFAFETulOSTgwt7Cq\"}"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-17e556.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"49477352-2886-4e19-b175-37160dab9b63","keyName":"e2e-rate-b-df747c","subscription":"e2e-rate-iso-b-df747c","tenant":"e2e-shared-b-17e556","userId":"49477352-2886-4e19-b175-37160dab9b63","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-17e556.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-17e556/rate-test-model-17e556\",\"requestedSubscription\":\"e2e-rate-iso-b-df747c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-17e556.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-17e556","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-df747c","namespace":"ai-tenant-e2e-shared-b-17e556","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bc396216-2467-440c-8ba8-ca7958393511","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-17e556/rate-test-model-17e556\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-df747c"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc396216-2467-440c-8ba8-ca7958393511","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"49477352-2886-4e19-b175-37160dab9b63","keyName":"e2e-rate-b-df747c","selected_subscription":"e2e-rate-iso-b-df747c","selected_subscription_key":"ai-tenant-e2e-shared-b-17e556/e2e-rate-iso-b-df747c@ai-tenant-e2e-shared-b-17e556/rate-test-model-17e556","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-17e556","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-df747c","namespace":"ai-tenant-e2e-shared-b-17e556","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bc396216-2467-440c-8ba8-ca7958393511","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:23:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bc396216-2467-440c-8ba8-ca7958393511","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a5de82c5aec7e5c9225d4978b05f6462c2a28003ea02a7ec59d304bf2543cd9b"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fc786a58890f8ec7728949e9711c99d9365562422caab843be45f1b73236bc97"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3268d38517941e93871c90339bf65caa3aaefe4bf95dfda5092d56cc59883088"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fc936591b727eed50ee10cdc3ee15d303798ea5dc0359890c887d94c91b1b5b3"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6df9cd07ce8afeed7139a025a10cba2e85a3b58fe678d9f5985b42dbe8b03413"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ddd59233bdd47780c4811019585c3dad2ca0530500ba4b15047953a8f47479d5"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a6de20ac261798dcfa45d0e8008a542d133f99066b22846a65e6dfaeeaa6221c"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/79371936cd2335651afa1c7a02e264f2b4655284d32e5d33d8fa720a05f092a7"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0e93aa20cf59e8c3f6497da361fa1bc4bc7aa89c9f1ddd967bf34bf59f380492"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee0d36db43f379b96fe9c61e2b61a7301e0ccabc8fdac91090d2c1ff57b21f7b"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c3a73b9fadf17beb5182c87b4bc15cd2b34eab14c8e943a8c9f6367853d84972"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e8fb342d890b13f22e4dc1d3ece45d457d2ae0ab0831316fcff2db25b17efe22"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b5673222e0ee20fb6b9bfc9805c52836835669997c9cd10579c1a699579f9794"}
{"level":"info","ts":"2026-07-07T16:23:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b2e8667827e8889cc39638a8439f85d43fd8930dc544f13e74d460a2989f36d"}
{"level":"info","ts":"2026-07-07T16:23:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/da0498e4adfed543512862711c263e1b5a0e8f4b7fff53f96061c81ecf9d4dc2"}
{"level":"info","ts":"2026-07-07T16:23:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/987aaf86533edd9636690c27e7db458ba29e4fc88d799d19d92ea227fbdb5bd0"}
{"level":"info","ts":"2026-07-07T16:23:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a5d430326b546cc934dffa1510159f4bc0aa2666d8b4176005592f150a958fa4"}
{"level":"info","ts":"2026-07-07T16:23:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f5fbf0a8489c0a06af2c3ea5e569414594709ecec73f7d9c1f85aa971fa82474"}
{"level":"info","ts":"2026-07-07T16:24:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3600b038a7736a51627ccfbf1a96a2c3d1c3d2e7c4d137c772b236e345bbbcbc"}
{"level":"info","ts":"2026-07-07T16:24:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d67bbaf0bbbe2c0d70ec1e1164f9419c36d207e330d84351cff7ac9589aa6a46"}