{"level":"debug","ts":"2026-07-02T22:15:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:15:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85"}
{"level":"debug","ts":"2026-07-02T22:15:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:15:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:15:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:15:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:15:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:15:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85"}
{"level":"debug","ts":"2026-07-02T22:16:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"91466c9dfb2eca68a110aa52429af3fd90e5e94b7a1f51e29df4fee3d7dce941","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/91466c9dfb2eca68a110aa52429af3fd90e5e94b7a1f51e29df4fee3d7dce941"}
{"level":"debug","ts":"2026-07-02T22:16:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3"}
{"level":"debug","ts":"2026-07-02T22:16:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3"}
{"level":"debug","ts":"2026-07-02T22:16:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc"}
{"level":"error","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df0ecdf1133c592b39cbf21e31bb6cc88f3a66231d86e7b88e3824b92bd7988a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df0ecdf1133c592b39cbf21e31bb6cc88f3a66231d86e7b88e3824b92bd7988a"}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85573e0567121ccae6d13dc1b65b1634b14be34716c5d6f0431ea1d37088d0b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85573e0567121ccae6d13dc1b65b1634b14be34716c5d6f0431ea1d37088d0b9"}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9"}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9"}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85"}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7875b716dc56217fdeabbb030e9ea174204baa9bdf3ce30498b12c15114d299","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7875b716dc56217fdeabbb030e9ea174204baa9bdf3ce30498b12c15114d299"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b0dc69170fbdf79a0a4ab3060c0f0e43079f101a7331041523ee29426f1ce7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b0dc69170fbdf79a0a4ab3060c0f0e43079f101a7331041523ee29426f1ce7c"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b0dc69170fbdf79a0a4ab3060c0f0e43079f101a7331041523ee29426f1ce7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40041217af0288a74172b958aa5d5f0ff5d46ed0de02b12e46063d2d09e3ff47"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40041217af0288a74172b958aa5d5f0ff5d46ed0de02b12e46063d2d09e3ff47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b95f3d5c05414b4b9c7a7929128b94cf5912d334b681548cfd3e534897a27362","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b95f3d5c05414b4b9c7a7929128b94cf5912d334b681548cfd3e534897a27362","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b0dc69170fbdf79a0a4ab3060c0f0e43079f101a7331041523ee29426f1ce7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b0dc69170fbdf79a0a4ab3060c0f0e43079f101a7331041523ee29426f1ce7c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b95f3d5c05414b4b9c7a7929128b94cf5912d334b681548cfd3e534897a27362"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b0dc69170fbdf79a0a4ab3060c0f0e43079f101a7331041523ee29426f1ce7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"440ebaf2b464ee2654c77e186e03eb0282a61968beb3cc46dd67f9a2dc1a0802","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b0dc69170fbdf79a0a4ab3060c0f0e43079f101a7331041523ee29426f1ce7c"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f983d363af8b6306a2dfa0fb7dade29f0bbfbf1b0a76bb782314d8e6fd84538","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b95f3d5c05414b4b9c7a7929128b94cf5912d334b681548cfd3e534897a27362","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T22:16:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b95f3d5c05414b4b9c7a7929128b94cf5912d334b681548cfd3e534897a27362"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b95f3d5c05414b4b9c7a7929128b94cf5912d334b681548cfd3e534897a27362","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1d3e20f3422af238ef7d55d0d1bbc38cf2fbe38eb28192a7a9f3f29debdea24e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b0dc69170fbdf79a0a4ab3060c0f0e43079f101a7331041523ee29426f1ce7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de8e906dc0e37bac4087f2d2e7f172048de82c3bc1692dcbe11afc1d6b074cec","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f793cb9149ba01de7564497357dbea161a62b9a9a3d147db66b3ee69c27add4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d5704c8e28a3101eea513e2b54b210db02a2c1f83d32f1ad2f191640e559f3ec","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b95f3d5c05414b4b9c7a7929128b94cf5912d334b681548cfd3e534897a27362","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/440ebaf2b464ee2654c77e186e03eb0282a61968beb3cc46dd67f9a2dc1a0802"}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c9c05e59b3e9badc65b0866c131ba02f60c14379047247a2ecfd121bfa723bd4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85"}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86042098c839c0b33d9a664067c16e46399a8b22a1ec6eab34d7c1d819ee170d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2"}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b544db044ff84f771e5c99ba68d5157333620847853a5bb83daef23bdfba0c01","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f983d363af8b6306a2dfa0fb7dade29f0bbfbf1b0a76bb782314d8e6fd84538"}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f18f3ad455fea1b5b88950f6014e89a78967745455acad2d003a26d317d31cae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e786750894a799155847637c4aa28a1e64efdca7e30a0533dd26cd87af59779","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b95f3d5c05414b4b9c7a7929128b94cf5912d334b681548cfd3e534897a27362"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1d3e20f3422af238ef7d55d0d1bbc38cf2fbe38eb28192a7a9f3f29debdea24e"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b0dc69170fbdf79a0a4ab3060c0f0e43079f101a7331041523ee29426f1ce7c"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de8e906dc0e37bac4087f2d2e7f172048de82c3bc1692dcbe11afc1d6b074cec"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f793cb9149ba01de7564497357dbea161a62b9a9a3d147db66b3ee69c27add4"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d5704c8e28a3101eea513e2b54b210db02a2c1f83d32f1ad2f191640e559f3ec"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c9c05e59b3e9badc65b0866c131ba02f60c14379047247a2ecfd121bfa723bd4"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86042098c839c0b33d9a664067c16e46399a8b22a1ec6eab34d7c1d819ee170d"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b544db044ff84f771e5c99ba68d5157333620847853a5bb83daef23bdfba0c01"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f18f3ad455fea1b5b88950f6014e89a78967745455acad2d003a26d317d31cae"}
{"level":"info","ts":"2026-07-02T22:16:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e786750894a799155847637c4aa28a1e64efdca7e30a0533dd26cd87af59779"}
{"level":"info","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:57028","PortSpecifier":{"PortValue":57028}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:57028","PortSpecifier":{"PortValue":57028}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030565,"nanos":969553867},"http":{"id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"40fbd0ca-e264-410b-a8bc-d27cd5b78520","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ff05ebd7-1458-491e-a663-976ef93b73bf"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f2c01d5ceb55"]}}
{"level":"debug","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f2c01d5ceb55"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ff05ebd7-1458-491e-a663-976ef93b73bf"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"40fbd0ca-e264-410b-a8bc-d27cd5b78520","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6f983d363af8b6306a2dfa0fb7dade29f0bbfbf1b0a76bb782314d8e6fd84538"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.30:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebce6d51-7380-49f0-8fb6-803ed1d1de58","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:37670","PortSpecifier":{"PortValue":37670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f2a709.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:37670","PortSpecifier":{"PortValue":37670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030566,"nanos":11824098},"http":{"id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","method":"POST","headers":{":authority":"e2e-shared-b-f2a709.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"40fbd0ca-e264-410b-a8bc-d27cd5b78520","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ff05ebd7-1458-491e-a663-976ef93b73bf"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f2c01d5ceb55"]}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f2c01d5ceb55"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ff05ebd7-1458-491e-a663-976ef93b73bf"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"40fbd0ca-e264-410b-a8bc-d27cd5b78520","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f2a709.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f2a709/rate-test-model-f2a709\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90b18125-ed8b-48d5-9fa9-6567ec94db16","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:57042","PortSpecifier":{"PortValue":57042}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:57042","PortSpecifier":{"PortValue":57042}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030566,"nanos":56073589},"http":{"id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QvsWmZsnzcWS3f6z_HFG8sqxDLNxs3rxXgsYPibUCl9iCWHxZLxYTd0tKdRU"}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QvsWmZsnzcWS3f6z_HFG8sqxDLNxs3rxXgsYPibUCl9iCWHxZLxYTd0tKdRU\"}"}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"99bfc719-2c60-4ccf-84cc-2b4b5bb2077a","keyName":"e2e-rate-a-8b6982","subscription":"e2e-rate-iso-a-8b6982","tenant":"e2e-shared-a-edb549","userId":"99bfc719-2c60-4ccf-84cc-2b4b5bb2077a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-8b6982\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8b6982","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8b6982"}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"99bfc719-2c60-4ccf-84cc-2b4b5bb2077a","keyName":"e2e-rate-a-8b6982","selected_subscription":"e2e-rate-iso-a-8b6982","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-8b6982@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8b6982","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6cd05d9-a5fd-4368-bd66-398c0b3b3faa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:57048","PortSpecifier":{"PortValue":57048}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ccb13466-382b-4562-b416-c71b5fe85d7d","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:57048","PortSpecifier":{"PortValue":57048}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030567,"nanos":116343502},"http":{"id":"ccb13466-382b-4562-b416-c71b5fe85d7d","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QvsWmZsnzcWS3f6z_HFG8sqxDLNxs3rxXgsYPibUCl9iCWHxZLxYTd0tKdRU"}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QvsWmZsnzcWS3f6z_HFG8sqxDLNxs3rxXgsYPibUCl9iCWHxZLxYTd0tKdRU\"}"}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"99bfc719-2c60-4ccf-84cc-2b4b5bb2077a","keyName":"e2e-rate-a-8b6982","subscription":"e2e-rate-iso-a-8b6982","tenant":"e2e-shared-a-edb549","userId":"99bfc719-2c60-4ccf-84cc-2b4b5bb2077a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-8b6982\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8b6982","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8b6982"}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"99bfc719-2c60-4ccf-84cc-2b4b5bb2077a","keyName":"e2e-rate-a-8b6982","selected_subscription":"e2e-rate-iso-a-8b6982","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-8b6982@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8b6982","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ccb13466-382b-4562-b416-c71b5fe85d7d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:57060","PortSpecifier":{"PortValue":57060}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:57060","PortSpecifier":{"PortValue":57060}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030568,"nanos":152741215},"http":{"id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QvsWmZsnzcWS3f6z_HFG8sqxDLNxs3rxXgsYPibUCl9iCWHxZLxYTd0tKdRU"}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QvsWmZsnzcWS3f6z_HFG8sqxDLNxs3rxXgsYPibUCl9iCWHxZLxYTd0tKdRU\"}"}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"99bfc719-2c60-4ccf-84cc-2b4b5bb2077a","keyName":"e2e-rate-a-8b6982","subscription":"e2e-rate-iso-a-8b6982","tenant":"e2e-shared-a-edb549","userId":"99bfc719-2c60-4ccf-84cc-2b4b5bb2077a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-8b6982\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8b6982","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8b6982"}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"99bfc719-2c60-4ccf-84cc-2b4b5bb2077a","keyName":"e2e-rate-a-8b6982","selected_subscription":"e2e-rate-iso-a-8b6982","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-8b6982@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8b6982","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3bf2f43-a9c5-42ec-b5eb-a313b8802fe9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:45398","PortSpecifier":{"PortValue":45398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:45398","PortSpecifier":{"PortValue":45398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030576,"nanos":896164046},"http":{"id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"40fbd0ca-e264-410b-a8bc-d27cd5b78520","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ff05ebd7-1458-491e-a663-976ef93b73bf"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f2c01d5ceb55"]}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f2c01d5ceb55"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ff05ebd7-1458-491e-a663-976ef93b73bf"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"40fbd0ca-e264-410b-a8bc-d27cd5b78520","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6f983d363af8b6306a2dfa0fb7dade29f0bbfbf1b0a76bb782314d8e6fd84538"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.30:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4c8ceb4d-7d68-4eab-9999-c67f103cae2d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:37076","PortSpecifier":{"PortValue":37076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f2a709.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:37076","PortSpecifier":{"PortValue":37076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030576,"nanos":935903718},"http":{"id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","method":"POST","headers":{":authority":"e2e-shared-b-f2a709.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"40fbd0ca-e264-410b-a8bc-d27cd5b78520","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=ff05ebd7-1458-491e-a663-976ef93b73bf"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f2c01d5ceb55"]}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f2c01d5ceb55"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=ff05ebd7-1458-491e-a663-976ef93b73bf"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"40fbd0ca-e264-410b-a8bc-d27cd5b78520","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f2a709.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f2a709/rate-test-model-f2a709\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff74bd34-2e76-4a14-a127-14d6eaf0a958","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:45414","PortSpecifier":{"PortValue":45414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7d70f86b-229d-44d6-830b-6557ff39fde3","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:45414","PortSpecifier":{"PortValue":45414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030576,"nanos":976274557},"http":{"id":"7d70f86b-229d-44d6-830b-6557ff39fde3","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma\"}"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","subscription":"e2e-rate-iso-a-4ae55f","tenant":"e2e-shared-a-edb549","userId":"02f22773-795c-491f-a881-73235097f0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-4ae55f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4ae55f"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","selected_subscription":"e2e-rate-iso-a-4ae55f","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-4ae55f@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d70f86b-229d-44d6-830b-6557ff39fde3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1aee7284-b001-4faa-ba22-056315276e05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:45420","PortSpecifier":{"PortValue":45420}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1aee7284-b001-4faa-ba22-056315276e05","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1aee7284-b001-4faa-ba22-056315276e05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:45420","PortSpecifier":{"PortValue":45420}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030578,"nanos":16657454},"http":{"id":"1aee7284-b001-4faa-ba22-056315276e05","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma"}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma\"}"}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","subscription":"e2e-rate-iso-a-4ae55f","tenant":"e2e-shared-a-edb549","userId":"02f22773-795c-491f-a881-73235097f0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-4ae55f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1aee7284-b001-4faa-ba22-056315276e05","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4ae55f"}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1aee7284-b001-4faa-ba22-056315276e05","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","selected_subscription":"e2e-rate-iso-a-4ae55f","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-4ae55f@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1aee7284-b001-4faa-ba22-056315276e05","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1aee7284-b001-4faa-ba22-056315276e05","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33322","PortSpecifier":{"PortValue":33322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33322","PortSpecifier":{"PortValue":33322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030579,"nanos":52758204},"http":{"id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma"}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma\"}"}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","subscription":"e2e-rate-iso-a-4ae55f","tenant":"e2e-shared-a-edb549","userId":"02f22773-795c-491f-a881-73235097f0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-4ae55f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4ae55f"}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","selected_subscription":"e2e-rate-iso-a-4ae55f","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-4ae55f@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"acdb2f7d-6482-4b0d-bf12-5c47147a4c79","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33328","PortSpecifier":{"PortValue":33328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33328","PortSpecifier":{"PortValue":33328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030580,"nanos":112851227},"http":{"id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma"}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma\"}"}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","subscription":"e2e-rate-iso-a-4ae55f","tenant":"e2e-shared-a-edb549","userId":"02f22773-795c-491f-a881-73235097f0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-4ae55f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4ae55f"}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","selected_subscription":"e2e-rate-iso-a-4ae55f","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-4ae55f@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ca7d287-b1ee-4bcd-b50a-b3f0da83d6e0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33340","PortSpecifier":{"PortValue":33340}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33340","PortSpecifier":{"PortValue":33340}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030581,"nanos":151255106},"http":{"id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma"}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma\"}"}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","subscription":"e2e-rate-iso-a-4ae55f","tenant":"e2e-shared-a-edb549","userId":"02f22773-795c-491f-a881-73235097f0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-4ae55f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4ae55f"}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","selected_subscription":"e2e-rate-iso-a-4ae55f","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-4ae55f@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a80fbb90-134c-431e-9711-e6f4a1f4b790","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33342","PortSpecifier":{"PortValue":33342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33342","PortSpecifier":{"PortValue":33342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030582,"nanos":187933143},"http":{"id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma"}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma\"}"}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","subscription":"e2e-rate-iso-a-4ae55f","tenant":"e2e-shared-a-edb549","userId":"02f22773-795c-491f-a881-73235097f0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-4ae55f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4ae55f"}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","selected_subscription":"e2e-rate-iso-a-4ae55f","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-4ae55f@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"181d1fb1-bf1f-43a8-9119-ca16f0ad7aa8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"566e5575-1322-4396-9a6a-badd44e68793","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33346","PortSpecifier":{"PortValue":33346}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"566e5575-1322-4396-9a6a-badd44e68793","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"566e5575-1322-4396-9a6a-badd44e68793","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33346","PortSpecifier":{"PortValue":33346}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030583,"nanos":225630605},"http":{"id":"566e5575-1322-4396-9a6a-badd44e68793","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma"}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma\"}"}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","subscription":"e2e-rate-iso-a-4ae55f","tenant":"e2e-shared-a-edb549","userId":"02f22773-795c-491f-a881-73235097f0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-4ae55f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"566e5575-1322-4396-9a6a-badd44e68793","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4ae55f"}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"566e5575-1322-4396-9a6a-badd44e68793","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","selected_subscription":"e2e-rate-iso-a-4ae55f","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-4ae55f@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"566e5575-1322-4396-9a6a-badd44e68793","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"566e5575-1322-4396-9a6a-badd44e68793","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d70fda5c-284b-49bb-877e-44fa93689561","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33358","PortSpecifier":{"PortValue":33358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d70fda5c-284b-49bb-877e-44fa93689561","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d70fda5c-284b-49bb-877e-44fa93689561","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33358","PortSpecifier":{"PortValue":33358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030584,"nanos":260661696},"http":{"id":"d70fda5c-284b-49bb-877e-44fa93689561","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma"}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma\"}"}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","subscription":"e2e-rate-iso-a-4ae55f","tenant":"e2e-shared-a-edb549","userId":"02f22773-795c-491f-a881-73235097f0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-4ae55f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d70fda5c-284b-49bb-877e-44fa93689561","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4ae55f"}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d70fda5c-284b-49bb-877e-44fa93689561","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","selected_subscription":"e2e-rate-iso-a-4ae55f","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-4ae55f@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d70fda5c-284b-49bb-877e-44fa93689561","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d70fda5c-284b-49bb-877e-44fa93689561","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33360","PortSpecifier":{"PortValue":33360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33360","PortSpecifier":{"PortValue":33360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030585,"nanos":298899300},"http":{"id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma"}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma\"}"}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","subscription":"e2e-rate-iso-a-4ae55f","tenant":"e2e-shared-a-edb549","userId":"02f22773-795c-491f-a881-73235097f0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-4ae55f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4ae55f"}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","selected_subscription":"e2e-rate-iso-a-4ae55f","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-4ae55f@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"802d8d21-61ef-4065-af8b-7e7e3f6ae0f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33376","PortSpecifier":{"PortValue":33376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","method":"POST","path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions","host":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33376","PortSpecifier":{"PortValue":33376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030586,"nanos":339011539},"http":{"id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","method":"POST","headers":{":authority":"e2e-shared-a-edb549.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1TJYQMMLs4yRWaCch_pn47XNqZr0N4W8Ve5swULaiWqCkZ5MSsRQrVKfrc5ma\"}"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","subscription":"e2e-rate-iso-a-4ae55f","tenant":"e2e-shared-a-edb549","userId":"02f22773-795c-491f-a881-73235097f0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\",\"requestedSubscription\":\"e2e-rate-iso-a-4ae55f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-edb549.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4ae55f"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"02f22773-795c-491f-a881-73235097f0ec","keyName":"e2e-rate-a-4ae55f","selected_subscription":"e2e-rate-iso-a-4ae55f","selected_subscription_key":"ai-tenant-e2e-shared-a-edb549/e2e-rate-iso-a-4ae55f@ai-tenant-e2e-shared-a-edb549/rate-test-model-edb549","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-edb549","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4ae55f","namespace":"ai-tenant-e2e-shared-a-edb549","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"784bba4b-3f28-4f76-b495-16b8f8d1a09b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33898","PortSpecifier":{"PortValue":33898}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","method":"POST","path":"/ai-tenant-e2e-shared-b-f2a709/rate-test-model-f2a709/v1/completions","host":"e2e-shared-b-f2a709.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.14:33898","PortSpecifier":{"PortValue":33898}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783030586,"nanos":377682775},"http":{"id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","method":"POST","headers":{":authority":"e2e-shared-b-f2a709.apps.e07daa04-becc-498d-9354-f2c01d5ceb55.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-f2a709/rate-test-model-f2a709/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-13wY56sxCs998NVxw_mBLBIiklK6pWcepUo1DRBn8Vvu1SGse3t0i6GYXNF5a"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-f2a709.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-13wY56sxCs998NVxw_mBLBIiklK6pWcepUo1DRBn8Vvu1SGse3t0i6GYXNF5a\"}"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f2a709.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"20040f30-1a48-42f8-bb3a-dcd84f3bb20b","keyName":"e2e-rate-b-4ae55f","subscription":"e2e-rate-iso-b-4ae55f","tenant":"e2e-shared-b-f2a709","userId":"20040f30-1a48-42f8-bb3a-dcd84f3bb20b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-f2a709.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-f2a709/rate-test-model-f2a709\",\"requestedSubscription\":\"e2e-rate-iso-b-4ae55f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f2a709.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-f2a709","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-4ae55f","namespace":"ai-tenant-e2e-shared-b-f2a709","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f2a709/rate-test-model-f2a709\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-4ae55f"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"20040f30-1a48-42f8-bb3a-dcd84f3bb20b","keyName":"e2e-rate-b-4ae55f","selected_subscription":"e2e-rate-iso-b-4ae55f","selected_subscription_key":"ai-tenant-e2e-shared-b-f2a709/e2e-rate-iso-b-4ae55f@ai-tenant-e2e-shared-b-f2a709/rate-test-model-f2a709","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-f2a709","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-4ae55f","namespace":"ai-tenant-e2e-shared-b-f2a709","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T22:16:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b810bd7-de3a-41e4-99d7-913f9e84311b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T22:16:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6c8290a1196bed32410b54223072ce130a9f09aadde5076892e7addfba123b85"}
{"level":"info","ts":"2026-07-02T22:16:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c7875b716dc56217fdeabbb030e9ea174204baa9bdf3ce30498b12c15114d299"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df0ecdf1133c592b39cbf21e31bb6cc88f3a66231d86e7b88e3824b92bd7988a"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3f793cb9149ba01de7564497357dbea161a62b9a9a3d147db66b3ee69c27add4"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c9c05e59b3e9badc65b0866c131ba02f60c14379047247a2ecfd121bfa723bd4"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e51af31269a950f0fdcdcb5737517e3307f6cf9706c026b957a4353a3bfd6cf9"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/91466c9dfb2eca68a110aa52429af3fd90e5e94b7a1f51e29df4fee3d7dce941"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ab558c9ed006e2c26305d0addd743e9b4c742cb6c6c7e2049e2aeafae64209fc"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1d3e20f3422af238ef7d55d0d1bbc38cf2fbe38eb28192a7a9f3f29debdea24e"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/440ebaf2b464ee2654c77e186e03eb0282a61968beb3cc46dd67f9a2dc1a0802"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f18f3ad455fea1b5b88950f6014e89a78967745455acad2d003a26d317d31cae"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/de8e906dc0e37bac4087f2d2e7f172048de82c3bc1692dcbe11afc1d6b074cec"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b544db044ff84f771e5c99ba68d5157333620847853a5bb83daef23bdfba0c01"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d5704c8e28a3101eea513e2b54b210db02a2c1f83d32f1ad2f191640e559f3ec"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2e786750894a799155847637c4aa28a1e64efdca7e30a0533dd26cd87af59779"}
{"level":"info","ts":"2026-07-02T22:16:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/40041217af0288a74172b958aa5d5f0ff5d46ed0de02b12e46063d2d09e3ff47"}
{"level":"info","ts":"2026-07-02T22:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85573e0567121ccae6d13dc1b65b1634b14be34716c5d6f0431ea1d37088d0b9"}
{"level":"info","ts":"2026-07-02T22:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b95f3d5c05414b4b9c7a7929128b94cf5912d334b681548cfd3e534897a27362"}
{"level":"info","ts":"2026-07-02T22:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6f983d363af8b6306a2dfa0fb7dade29f0bbfbf1b0a76bb782314d8e6fd84538"}
{"level":"info","ts":"2026-07-02T22:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8b0dc69170fbdf79a0a4ab3060c0f0e43079f101a7331041523ee29426f1ce7c"}
{"level":"info","ts":"2026-07-02T22:17:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8b3a5060cecaa12a45e8a34a8be7fa66c25107825c4d88b31c0b6ca5494ad012"}
{"level":"info","ts":"2026-07-02T22:17:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/af8ef3d0bcee741e30f5200072d909355bf55facf93348075b9219354682bdf2"}
{"level":"info","ts":"2026-07-02T22:17:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/86042098c839c0b33d9a664067c16e46399a8b22a1ec6eab34d7c1d819ee170d"}
{"level":"info","ts":"2026-07-02T22:17:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c091553ec0d74b202c9de635b22052c22b521ecf324137fce8e2743bf2429bb3"}