{"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bd88575b-3560-4e8c-a8a3-67256d1cb632","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bd88575b-3560-4e8c-a8a3-67256d1cb632","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bd88575b-3560-4e8c-a8a3-67256d1cb632","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1231ba/rate-test-model-1231ba\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1231ba/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bd88575b-3560-4e8c-a8a3-67256d1cb632","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bd88575b-3560-4e8c-a8a3-67256d1cb632","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bd88575b-3560-4e8c-a8a3-67256d1cb632","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bd88575b-3560-4e8c-a8a3-67256d1cb632","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bd88575b-3560-4e8c-a8a3-67256d1cb632","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:37172","PortSpecifier":{"PortValue":37172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","method":"POST","path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions","host":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:37172","PortSpecifier":{"PortValue":37172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271058,"nanos":960394440},"http":{"id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","method":"POST","headers":{":authority":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Dcvpmk8dKrayA85k_7nePWZsONcxBoNApRgS9DjeYb9sXplfp4TglJgaR3Bl"} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Dcvpmk8dKrayA85k_7nePWZsONcxBoNApRgS9DjeYb9sXplfp4TglJgaR3Bl\"}"} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"71f3605d-ffd5-42d0-b5de-2976f61be025","keyName":"e2e-rate-a-c01d9c","subscription":"e2e-rate-iso-a-c01d9c","tenant":"e2e-shared-a-ed54db","userId":"71f3605d-ffd5-42d0-b5de-2976f61be025","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\",\"requestedSubscription\":\"e2e-rate-iso-a-c01d9c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c01d9c","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"}} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c01d9c"} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"71f3605d-ffd5-42d0-b5de-2976f61be025","keyName":"e2e-rate-a-c01d9c","selected_subscription":"e2e-rate-iso-a-c01d9c","selected_subscription_key":"ai-tenant-e2e-shared-a-ed54db/e2e-rate-iso-a-c01d9c@ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c01d9c","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:37:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f828a12c-4b04-49a0-8e29-bb6aa1b778eb","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:37184","PortSpecifier":{"PortValue":37184}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","method":"POST","path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions","host":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:37184","PortSpecifier":{"PortValue":37184}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271060,"nanos":53069945},"http":{"id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","method":"POST","headers":{":authority":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Dcvpmk8dKrayA85k_7nePWZsONcxBoNApRgS9DjeYb9sXplfp4TglJgaR3Bl"} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Dcvpmk8dKrayA85k_7nePWZsONcxBoNApRgS9DjeYb9sXplfp4TglJgaR3Bl\"}"} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"71f3605d-ffd5-42d0-b5de-2976f61be025","keyName":"e2e-rate-a-c01d9c","subscription":"e2e-rate-iso-a-c01d9c","tenant":"e2e-shared-a-ed54db","userId":"71f3605d-ffd5-42d0-b5de-2976f61be025","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\",\"requestedSubscription\":\"e2e-rate-iso-a-c01d9c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c01d9c","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"}} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c01d9c"} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"71f3605d-ffd5-42d0-b5de-2976f61be025","keyName":"e2e-rate-a-c01d9c","selected_subscription":"e2e-rate-iso-a-c01d9c","selected_subscription_key":"ai-tenant-e2e-shared-a-ed54db/e2e-rate-iso-a-c01d9c@ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c01d9c","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:37:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46f14e4f-e677-4dd4-a033-2d3c48ba2da2","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:37196","PortSpecifier":{"PortValue":37196}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a0729871-a4f0-40bf-aa78-932878bd72e9","method":"POST","path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions","host":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:37196","PortSpecifier":{"PortValue":37196}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271061,"nanos":95454754},"http":{"id":"a0729871-a4f0-40bf-aa78-932878bd72e9","method":"POST","headers":{":authority":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Dcvpmk8dKrayA85k_7nePWZsONcxBoNApRgS9DjeYb9sXplfp4TglJgaR3Bl"} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Dcvpmk8dKrayA85k_7nePWZsONcxBoNApRgS9DjeYb9sXplfp4TglJgaR3Bl\"}"} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"71f3605d-ffd5-42d0-b5de-2976f61be025","keyName":"e2e-rate-a-c01d9c","subscription":"e2e-rate-iso-a-c01d9c","tenant":"e2e-shared-a-ed54db","userId":"71f3605d-ffd5-42d0-b5de-2976f61be025","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\",\"requestedSubscription\":\"e2e-rate-iso-a-c01d9c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c01d9c","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"}} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c01d9c"} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"71f3605d-ffd5-42d0-b5de-2976f61be025","keyName":"e2e-rate-a-c01d9c","selected_subscription":"e2e-rate-iso-a-c01d9c","selected_subscription_key":"ai-tenant-e2e-shared-a-ed54db/e2e-rate-iso-a-c01d9c@ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c01d9c","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:37:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a0729871-a4f0-40bf-aa78-932878bd72e9","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53238","PortSpecifier":{"PortValue":53238}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53238","PortSpecifier":{"PortValue":53238}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271082,"nanos":494431325},"http":{"id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","method":"POST","headers":{":authority":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f436c4ef-cabd-461b-b8a0-5cd04b4074b1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0f860f24-ee5a-4f26-a017-c5386aa59035"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/82554535de06"]}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/82554535de06"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0f860f24-ee5a-4f26-a017-c5386aa59035"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f436c4ef-cabd-461b-b8a0-5cd04b4074b1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2f183119fa52e07dbd2b6d8c752b7ef2594320855b2e07a4223cfbe810678948"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cbdb3cab-5d96-4cc5-aec1-ec2c91a5a6a8","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38002","PortSpecifier":{"PortValue":38002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b80d5db7-f7c3-494d-b289-62f27f975c08","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-1231ba.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:38002","PortSpecifier":{"PortValue":38002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271082,"nanos":534873573},"http":{"id":"b80d5db7-f7c3-494d-b289-62f27f975c08","method":"POST","headers":{":authority":"e2e-shared-b-1231ba.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f436c4ef-cabd-461b-b8a0-5cd04b4074b1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0f860f24-ee5a-4f26-a017-c5386aa59035"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/82554535de06"]}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/82554535de06"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0f860f24-ee5a-4f26-a017-c5386aa59035"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f436c4ef-cabd-461b-b8a0-5cd04b4074b1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b40a252f2e7be47eeac9e0c83bc13bf8945279b883122c7c7e5ed8b1793ce716"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-1231ba.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1231ba/rate-test-model-1231ba\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1231ba/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b80d5db7-f7c3-494d-b289-62f27f975c08","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53252","PortSpecifier":{"PortValue":53252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3437d29a-26d9-49e0-a78e-2ecab70281df","method":"POST","path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions","host":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53252","PortSpecifier":{"PortValue":53252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271082,"nanos":568785772},"http":{"id":"3437d29a-26d9-49e0-a78e-2ecab70281df","method":"POST","headers":{":authority":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2jcnBRToTxNCyx4I_kFbNawTW4gKTn6IUAaWQKwexozmSdzbP7m7zJ6Tvn6j"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2jcnBRToTxNCyx4I_kFbNawTW4gKTn6IUAaWQKwexozmSdzbP7m7zJ6Tvn6j\"}"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","keyName":"e2e-rate-a-295d9a","subscription":"e2e-rate-iso-a-295d9a","tenant":"e2e-shared-a-ed54db","userId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\",\"requestedSubscription\":\"e2e-rate-iso-a-295d9a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-295d9a","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-295d9a"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","keyName":"e2e-rate-a-295d9a","selected_subscription":"e2e-rate-iso-a-295d9a","selected_subscription_key":"ai-tenant-e2e-shared-a-ed54db/e2e-rate-iso-a-295d9a@ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-295d9a","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:38:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3437d29a-26d9-49e0-a78e-2ecab70281df","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"67926809-364c-4033-af0d-a910bbd32b32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53260","PortSpecifier":{"PortValue":53260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"67926809-364c-4033-af0d-a910bbd32b32","method":"POST","path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions","host":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"67926809-364c-4033-af0d-a910bbd32b32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53260","PortSpecifier":{"PortValue":53260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271083,"nanos":612813044},"http":{"id":"67926809-364c-4033-af0d-a910bbd32b32","method":"POST","headers":{":authority":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2jcnBRToTxNCyx4I_kFbNawTW4gKTn6IUAaWQKwexozmSdzbP7m7zJ6Tvn6j"} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2jcnBRToTxNCyx4I_kFbNawTW4gKTn6IUAaWQKwexozmSdzbP7m7zJ6Tvn6j\"}"} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","keyName":"e2e-rate-a-295d9a","subscription":"e2e-rate-iso-a-295d9a","tenant":"e2e-shared-a-ed54db","userId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\",\"requestedSubscription\":\"e2e-rate-iso-a-295d9a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-295d9a","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"}} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"67926809-364c-4033-af0d-a910bbd32b32","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-295d9a"} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67926809-364c-4033-af0d-a910bbd32b32","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","keyName":"e2e-rate-a-295d9a","selected_subscription":"e2e-rate-iso-a-295d9a","selected_subscription_key":"ai-tenant-e2e-shared-a-ed54db/e2e-rate-iso-a-295d9a@ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-295d9a","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"67926809-364c-4033-af0d-a910bbd32b32","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:38:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"67926809-364c-4033-af0d-a910bbd32b32","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"602c6037-4e41-48a1-9929-357809d6a70e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:55002","PortSpecifier":{"PortValue":55002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"602c6037-4e41-48a1-9929-357809d6a70e","method":"POST","path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions","host":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"602c6037-4e41-48a1-9929-357809d6a70e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:55002","PortSpecifier":{"PortValue":55002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271084,"nanos":652158462},"http":{"id":"602c6037-4e41-48a1-9929-357809d6a70e","method":"POST","headers":{":authority":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2jcnBRToTxNCyx4I_kFbNawTW4gKTn6IUAaWQKwexozmSdzbP7m7zJ6Tvn6j"} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2jcnBRToTxNCyx4I_kFbNawTW4gKTn6IUAaWQKwexozmSdzbP7m7zJ6Tvn6j\"}"} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","keyName":"e2e-rate-a-295d9a","subscription":"e2e-rate-iso-a-295d9a","tenant":"e2e-shared-a-ed54db","userId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\",\"requestedSubscription\":\"e2e-rate-iso-a-295d9a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-295d9a","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"}} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"602c6037-4e41-48a1-9929-357809d6a70e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-295d9a"} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"602c6037-4e41-48a1-9929-357809d6a70e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","keyName":"e2e-rate-a-295d9a","selected_subscription":"e2e-rate-iso-a-295d9a","selected_subscription_key":"ai-tenant-e2e-shared-a-ed54db/e2e-rate-iso-a-295d9a@ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-295d9a","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"602c6037-4e41-48a1-9929-357809d6a70e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:38:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"602c6037-4e41-48a1-9929-357809d6a70e","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:55004","PortSpecifier":{"PortValue":55004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"07d10a98-f610-438f-b39b-2f413612cdcf","method":"POST","path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions","host":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:55004","PortSpecifier":{"PortValue":55004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271085,"nanos":695665679},"http":{"id":"07d10a98-f610-438f-b39b-2f413612cdcf","method":"POST","headers":{":authority":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2jcnBRToTxNCyx4I_kFbNawTW4gKTn6IUAaWQKwexozmSdzbP7m7zJ6Tvn6j"} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2jcnBRToTxNCyx4I_kFbNawTW4gKTn6IUAaWQKwexozmSdzbP7m7zJ6Tvn6j\"}"} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","keyName":"e2e-rate-a-295d9a","subscription":"e2e-rate-iso-a-295d9a","tenant":"e2e-shared-a-ed54db","userId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\",\"requestedSubscription\":\"e2e-rate-iso-a-295d9a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-295d9a","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"}} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-295d9a"} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","keyName":"e2e-rate-a-295d9a","selected_subscription":"e2e-rate-iso-a-295d9a","selected_subscription_key":"ai-tenant-e2e-shared-a-ed54db/e2e-rate-iso-a-295d9a@ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-295d9a","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:38:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07d10a98-f610-438f-b39b-2f413612cdcf","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:55016","PortSpecifier":{"PortValue":55016}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","method":"POST","path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions","host":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:55016","PortSpecifier":{"PortValue":55016}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271086,"nanos":741699398},"http":{"id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","method":"POST","headers":{":authority":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2jcnBRToTxNCyx4I_kFbNawTW4gKTn6IUAaWQKwexozmSdzbP7m7zJ6Tvn6j"} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2jcnBRToTxNCyx4I_kFbNawTW4gKTn6IUAaWQKwexozmSdzbP7m7zJ6Tvn6j\"}"} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","keyName":"e2e-rate-a-295d9a","subscription":"e2e-rate-iso-a-295d9a","tenant":"e2e-shared-a-ed54db","userId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\",\"requestedSubscription\":\"e2e-rate-iso-a-295d9a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-295d9a","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"}} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-295d9a"} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","keyName":"e2e-rate-a-295d9a","selected_subscription":"e2e-rate-iso-a-295d9a","selected_subscription_key":"ai-tenant-e2e-shared-a-ed54db/e2e-rate-iso-a-295d9a@ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-295d9a","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:38:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32a07ff6-5298-443f-ada9-8ec2ba43c4fc","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:55024","PortSpecifier":{"PortValue":55024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","method":"POST","path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions","host":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:55024","PortSpecifier":{"PortValue":55024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271087,"nanos":781826806},"http":{"id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","method":"POST","headers":{":authority":"e2e-shared-a-ed54db.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2jcnBRToTxNCyx4I_kFbNawTW4gKTn6IUAaWQKwexozmSdzbP7m7zJ6Tvn6j"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2jcnBRToTxNCyx4I_kFbNawTW4gKTn6IUAaWQKwexozmSdzbP7m7zJ6Tvn6j\"}"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","keyName":"e2e-rate-a-295d9a","subscription":"e2e-rate-iso-a-295d9a","tenant":"e2e-shared-a-ed54db","userId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\",\"requestedSubscription\":\"e2e-rate-iso-a-295d9a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed54db.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-295d9a","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-295d9a"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c980b22b-fe92-436c-b2f5-99bbcf9bb18e","keyName":"e2e-rate-a-295d9a","selected_subscription":"e2e-rate-iso-a-295d9a","selected_subscription_key":"ai-tenant-e2e-shared-a-ed54db/e2e-rate-iso-a-295d9a@ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-ed54db/models/facebook/opt-125m","name":"rate-test-model-ed54db","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-295d9a","namespace":"ai-tenant-e2e-shared-a-ed54db","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed54db/rate-test-model-ed54db"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d8ebf5fc-e012-4fc6-8a21-ff089785d42d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57860","PortSpecifier":{"PortValue":57860}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","method":"POST","path":"/ai-tenant-e2e-shared-b-1231ba/rate-test-model-1231ba/v1/completions","host":"e2e-shared-b-1231ba.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57860","PortSpecifier":{"PortValue":57860}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271087,"nanos":820037910},"http":{"id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","method":"POST","headers":{":authority":"e2e-shared-b-1231ba.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-1231ba/rate-test-model-1231ba/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-CwKqXWsKcV2K4Y0e_t5vmQzeLTV3dNCqGvb5dIDYKVZgLhYPbqdI4dzLvNqQ"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-1231ba.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-CwKqXWsKcV2K4Y0e_t5vmQzeLTV3dNCqGvb5dIDYKVZgLhYPbqdI4dzLvNqQ\"}"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-1231ba.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9d5d0d13-e272-4975-b4aa-5e1f83aca43f","keyName":"e2e-rate-b-295d9a","subscription":"e2e-rate-iso-b-295d9a","tenant":"e2e-shared-b-1231ba","userId":"9d5d0d13-e272-4975-b4aa-5e1f83aca43f","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-1231ba.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-1231ba/rate-test-model-1231ba\",\"requestedSubscription\":\"e2e-rate-iso-b-295d9a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-1231ba.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-1231ba/models/facebook/opt-125m","name":"rate-test-model-1231ba","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-295d9a","namespace":"ai-tenant-e2e-shared-b-1231ba","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-1231ba/rate-test-model-1231ba"}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1231ba/rate-test-model-1231ba\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1231ba/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-295d9a"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9d5d0d13-e272-4975-b4aa-5e1f83aca43f","keyName":"e2e-rate-b-295d9a","selected_subscription":"e2e-rate-iso-b-295d9a","selected_subscription_key":"ai-tenant-e2e-shared-b-1231ba/e2e-rate-iso-b-295d9a@ai-tenant-e2e-shared-b-1231ba/rate-test-model-1231ba","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-1231ba/models/facebook/opt-125m","name":"rate-test-model-1231ba","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-295d9a","namespace":"ai-tenant-e2e-shared-b-1231ba","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-1231ba/rate-test-model-1231ba"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:38:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fc0604c9-bddd-465a-9860-e2108e73ba7e","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:38:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8ae5fe4665bcedc1e1f628901bb1e36ba8752a69be91eda1b7ea1ef8de23124f"} {"level":"info","ts":"2026-07-28T20:38:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0d3485cce72a1ecffc29c29f6901829f08dce3a1d856f11e5f11d89e303d638d"} {"level":"info","ts":"2026-07-28T20:38:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2f183119fa52e07dbd2b6d8c752b7ef2594320855b2e07a4223cfbe810678948"} {"level":"info","ts":"2026-07-28T20:38:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2d8cf541081bc7c05b0a2ef06fe51fc9b8a4fdfe7160a4a926644b2f50e870af"} {"level":"info","ts":"2026-07-28T20:38:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5d0656a174d321a479d53cd7b0f3f239da62acdba7d8ec5339fa6c3c04c1e41d"} {"level":"info","ts":"2026-07-28T20:38:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6db12fed431ab6503aad38f3da45dccc5fa5f23543555eda6f466571c78da500"} {"level":"info","ts":"2026-07-28T20:38:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1c2fee303afc75f045588a5377a6defd12283b593151cb1ab516193a1ddd16a5"} {"level":"info","ts":"2026-07-28T20:38:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/81568bb7744a7fe5646d3c6986eb941d12e83c2df7f4c6a4e671a2efd8588456"} {"level":"info","ts":"2026-07-28T20:38:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/84d41fbe70e13c13a9c7668f79cd0135d3165f23b11a2109c3a531b7cf4e26eb"} {"level":"info","ts":"2026-07-28T20:38:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85e0f1d84716fb9de8007840186b48d64dace2ac86b1949b1b3c8385103ae86b"} {"level":"info","ts":"2026-07-28T20:38:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c6a8521f367d377df44bf6a67429af3e324a9de07fa131f37084cd8fc17f9a43"} {"level":"info","ts":"2026-07-28T20:38:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e6e029377131f0e139c8225d732a2565b6b147eafbcb74c836b704f6b3665267"} {"level":"info","ts":"2026-07-28T20:38:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8c72d1953383801616ada3d5e46f791685f250dd6c2c995cbeb9d9f28bd21c8d"} {"level":"info","ts":"2026-07-28T20:38:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dfd8110ef213f96a7b7a3aefd7b172133786722e6fae461ddf9a71851ef1807b"} {"level":"info","ts":"2026-07-28T20:38:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b40a252f2e7be47eeac9e0c83bc13bf8945279b883122c7c7e5ed8b1793ce716"} {"level":"info","ts":"2026-07-28T20:38:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ba017488106351a20ba0df814e28602e54f62d1c05b12ae548082a6e7920da49"} {"level":"info","ts":"2026-07-28T20:38:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/78f4b448fc17294a52626ec382b294ed42b5f48d8e248dbfe8f638e9802e5c65"} {"level":"info","ts":"2026-07-28T20:38:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d40b8d23b36f5632f2addea0a419f22e4b5590bd8ad9d340c25cd082d53ca3fd"} {"level":"info","ts":"2026-07-28T20:38:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/73ad187104c263a8e73979a0564493cdf9b8900a97b1611451aa9ab9dbe9031f"} {"level":"info","ts":"2026-07-28T20:38:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/583e78e517d083697359cae7525192e2fc79a55fe23088602ace25b49deaf997"} {"level":"info","ts":"2026-07-28T20:38:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cb0dee54ab9163e23e0a3f3c6860a188e54a27688c5fe580d14964459457d752"} {"level":"info","ts":"2026-07-28T20:38:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6cbfea960127abc2169caf5439f403bbf96506dea9105ef0e692ac0aef007413"} {"level":"info","ts":"2026-07-28T20:38:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3b9846f868a20d3b25b9c9c1bc22b5dd29dde1c057bb286ae02843aecdadef4b"} {"level":"info","ts":"2026-07-28T20:38:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1c644852781cc171173b877e587159c1efc77da0432f9e3d8de15f9e0c03e4b8"} {"level":"info","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:59210","PortSpecifier":{"PortValue":59210}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:59210","PortSpecifier":{"PortValue":59210}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271171,"nanos":831758009},"http":{"id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","method":"POST","headers":{":authority":"maas.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f436c4ef-cabd-461b-b8a0-5cd04b4074b1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0f860f24-ee5a-4f26-a017-c5386aa59035"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/82554535de06"]}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/82554535de06"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0f860f24-ee5a-4f26-a017-c5386aa59035"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f436c4ef-cabd-461b-b8a0-5cd04b4074b1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d0b5359-3bb7-4483-a68c-773c913b4d63","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:59226","PortSpecifier":{"PortValue":59226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:59226","PortSpecifier":{"PortValue":59226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271171,"nanos":883929847},"http":{"id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","method":"POST","headers":{":authority":"maas.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-xzMS4U6z8YBonfl2_NRoi6UF52x81sIBub2vhAwvM4K70iSwfJRy5YJ7vVYO"} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-xzMS4U6z8YBonfl2_NRoi6UF52x81sIBub2vhAwvM4K70iSwfJRy5YJ7vVYO\"}"} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"663ce1f1-eb28-4451-9024-ce6eac2b89ef","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"663ce1f1-eb28-4451-9024-ce6eac2b89ef","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"663ce1f1-eb28-4451-9024-ce6eac2b89ef","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:39:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a3a4772c-dc71-4ceb-90da-0d57daf0911d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017"} {"level":"error","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017"} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017"} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017"} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f698ce589f3b61742ba92220c4d6875bb711bdd3ab173a1c5305f3b3aba57d92","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f698ce589f3b61742ba92220c4d6875bb711bdd3ab173a1c5305f3b3aba57d92"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f698ce589f3b61742ba92220c4d6875bb711bdd3ab173a1c5305f3b3aba57d92","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f698ce589f3b61742ba92220c4d6875bb711bdd3ab173a1c5305f3b3aba57d92","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f698ce589f3b61742ba92220c4d6875bb711bdd3ab173a1c5305f3b3aba57d92"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f698ce589f3b61742ba92220c4d6875bb711bdd3ab173a1c5305f3b3aba57d92","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f698ce589f3b61742ba92220c4d6875bb711bdd3ab173a1c5305f3b3aba57d92"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f698ce589f3b61742ba92220c4d6875bb711bdd3ab173a1c5305f3b3aba57d92"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f698ce589f3b61742ba92220c4d6875bb711bdd3ab173a1c5305f3b3aba57d92","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac"} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b87c3b4b30ea462e7d223ded00cbf29361ebe9ca177fc981e4e96551eebd9dc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b87c3b4b30ea462e7d223ded00cbf29361ebe9ca177fc981e4e96551eebd9dc6","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b87c3b4b30ea462e7d223ded00cbf29361ebe9ca177fc981e4e96551eebd9dc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b87c3b4b30ea462e7d223ded00cbf29361ebe9ca177fc981e4e96551eebd9dc6"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b87c3b4b30ea462e7d223ded00cbf29361ebe9ca177fc981e4e96551eebd9dc6","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b87c3b4b30ea462e7d223ded00cbf29361ebe9ca177fc981e4e96551eebd9dc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b87c3b4b30ea462e7d223ded00cbf29361ebe9ca177fc981e4e96551eebd9dc6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b87c3b4b30ea462e7d223ded00cbf29361ebe9ca177fc981e4e96551eebd9dc6","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b87c3b4b30ea462e7d223ded00cbf29361ebe9ca177fc981e4e96551eebd9dc6"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b87c3b4b30ea462e7d223ded00cbf29361ebe9ca177fc981e4e96551eebd9dc6","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5"} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"} {"level":"error","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b87c3b4b30ea462e7d223ded00cbf29361ebe9ca177fc981e4e96551eebd9dc6"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5"} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4"} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4a6f9db5e3e6167fe0f7033b28f358ee905dca528eb5b6fedd0d4451564e1793","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4a6f9db5e3e6167fe0f7033b28f358ee905dca528eb5b6fedd0d4451564e1793","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4a6f9db5e3e6167fe0f7033b28f358ee905dca528eb5b6fedd0d4451564e1793"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c5f89f33c497cf5bb0294684e063b730ef08b196a6a991d1b53f19716f5525a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c5f89f33c497cf5bb0294684e063b730ef08b196a6a991d1b53f19716f5525a","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4"} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4a6f9db5e3e6167fe0f7033b28f358ee905dca528eb5b6fedd0d4451564e1793","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4a6f9db5e3e6167fe0f7033b28f358ee905dca528eb5b6fedd0d4451564e1793"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c5f89f33c497cf5bb0294684e063b730ef08b196a6a991d1b53f19716f5525a"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4a6f9db5e3e6167fe0f7033b28f358ee905dca528eb5b6fedd0d4451564e1793","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18678f42b3664888e8ed4cd56607a1676f27f8d9ec36aeb9d1bae9fec2085b50","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4a6f9db5e3e6167fe0f7033b28f358ee905dca528eb5b6fedd0d4451564e1793"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18678f42b3664888e8ed4cd56607a1676f27f8d9ec36aeb9d1bae9fec2085b50","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c5f89f33c497cf5bb0294684e063b730ef08b196a6a991d1b53f19716f5525a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6c5f89f33c497cf5bb0294684e063b730ef08b196a6a991d1b53f19716f5525a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18678f42b3664888e8ed4cd56607a1676f27f8d9ec36aeb9d1bae9fec2085b50"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c5f89f33c497cf5bb0294684e063b730ef08b196a6a991d1b53f19716f5525a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4a6f9db5e3e6167fe0f7033b28f358ee905dca528eb5b6fedd0d4451564e1793","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18678f42b3664888e8ed4cd56607a1676f27f8d9ec36aeb9d1bae9fec2085b50","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T20:40:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18678f42b3664888e8ed4cd56607a1676f27f8d9ec36aeb9d1bae9fec2085b50"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18678f42b3664888e8ed4cd56607a1676f27f8d9ec36aeb9d1bae9fec2085b50","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c5f89f33c497cf5bb0294684e063b730ef08b196a6a991d1b53f19716f5525a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18678f42b3664888e8ed4cd56607a1676f27f8d9ec36aeb9d1bae9fec2085b50","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c5f89f33c497cf5bb0294684e063b730ef08b196a6a991d1b53f19716f5525a"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4a6f9db5e3e6167fe0f7033b28f358ee905dca528eb5b6fedd0d4451564e1793"} {"level":"info","ts":"2026-07-28T20:40:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18678f42b3664888e8ed4cd56607a1676f27f8d9ec36aeb9d1bae9fec2085b50"} {"level":"info","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52110","PortSpecifier":{"PortValue":52110}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.84:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-92ba10.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52110","PortSpecifier":{"PortValue":52110}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.84:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271222,"nanos":264226526},"http":{"id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","method":"POST","headers":{":authority":"e2e-ipp-a-92ba10.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f436c4ef-cabd-461b-b8a0-5cd04b4074b1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0f860f24-ee5a-4f26-a017-c5386aa59035"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/82554535de06"]}} {"level":"debug","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/82554535de06"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0f860f24-ee5a-4f26-a017-c5386aa59035"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f436c4ef-cabd-461b-b8a0-5cd04b4074b1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.84:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-92ba10.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-92ba10/ipp-route-92ba10\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-92ba10/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:40:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"702672d7-7bc7-4991-ac88-218c54fbfbdf","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96397308-894d-4d7d-a340-8b77fd298095","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:48368","PortSpecifier":{"PortValue":48368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.84:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"96397308-894d-4d7d-a340-8b77fd298095","method":"POST","path":"/ai-tenant-e2e-ipp-a-92ba10/ipp-route-92ba10/v1/chat/completions","host":"e2e-ipp-a-92ba10.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96397308-894d-4d7d-a340-8b77fd298095","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:48368","PortSpecifier":{"PortValue":48368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.84:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785271224,"nanos":336111790},"http":{"id":"96397308-894d-4d7d-a340-8b77fd298095","method":"POST","headers":{":authority":"e2e-ipp-a-92ba10.apps.4777417d-3e11-4e76-9cba-82554535de06.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-92ba10/ipp-route-92ba10/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-rODHVzqIwqJgxhSS_Gtz9EymgoyhxE2UFsFUCtgEarAKxDqRtgc64twiHgeU"} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-92ba10.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-rODHVzqIwqJgxhSS_Gtz9EymgoyhxE2UFsFUCtgEarAKxDqRtgc64twiHgeU\"}"} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-92ba10.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f32bfa23-c685-4f02-9828-a79c59837bf5","keyName":"e2e-ipp-92ba10","subscription":"ipp-route-92ba10-sub","tenant":"e2e-ipp-a-92ba10","userId":"f32bfa23-c685-4f02-9828-a79c59837bf5","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-92ba10.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-92ba10/ipp-route-92ba10\",\"requestedSubscription\":\"ipp-route-92ba10-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-92ba10.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-92ba10/models/facebook/opt-125m","name":"ipp-route-92ba10","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-92ba10-sub","namespace":"ai-tenant-e2e-ipp-a-92ba10","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-92ba10/ipp-route-92ba10"}} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"96397308-894d-4d7d-a340-8b77fd298095","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-92ba10/ipp-route-92ba10\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-92ba10/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-92ba10-sub"} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96397308-894d-4d7d-a340-8b77fd298095","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f32bfa23-c685-4f02-9828-a79c59837bf5","keyName":"e2e-ipp-92ba10","selected_subscription":"ipp-route-92ba10-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-92ba10/ipp-route-92ba10-sub@ai-tenant-e2e-ipp-a-92ba10/ipp-route-92ba10","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-92ba10/models/facebook/opt-125m","name":"ipp-route-92ba10","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-92ba10-sub","namespace":"ai-tenant-e2e-ipp-a-92ba10","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-92ba10/ipp-route-92ba10"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96397308-894d-4d7d-a340-8b77fd298095","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-28T20:40:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96397308-894d-4d7d-a340-8b77fd298095","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-28T20:41:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b87c3b4b30ea462e7d223ded00cbf29361ebe9ca177fc981e4e96551eebd9dc6"} {"level":"info","ts":"2026-07-28T20:41:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4a6f9db5e3e6167fe0f7033b28f358ee905dca528eb5b6fedd0d4451564e1793"} {"level":"info","ts":"2026-07-28T20:41:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/54312446743aae5cc8f29555449d2081fb3887adfe60c69e507f7bcf6dcf4017"} {"level":"info","ts":"2026-07-28T20:41:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d99c68c3c43b8ef7da4ab0ab90fe67489aca8ab8d55319eb173d68d3c6f057c4"} {"level":"info","ts":"2026-07-28T20:41:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3b5b38ee7e8cc1f29ccd3538b43f0d7b5df3c286ce4a008203cdc92b006a5dac"} {"level":"info","ts":"2026-07-28T20:41:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3cb8b7b7b1ea5ca843cae67465a959a1802174fa30e75c638883715610d6ca5b"} {"level":"info","ts":"2026-07-28T20:41:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f698ce589f3b61742ba92220c4d6875bb711bdd3ab173a1c5305f3b3aba57d92"} {"level":"info","ts":"2026-07-28T20:41:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a90644631871713bbbdfcc0fea7d838559b974949383e04ede128af0d9247e24"} {"level":"info","ts":"2026-07-28T20:41:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1ef8c809d3cb01f655468ce4d175d3b991eb5a3a7eff1197c9a852d7a93518f5"} {"level":"info","ts":"2026-07-28T20:41:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/18678f42b3664888e8ed4cd56607a1676f27f8d9ec36aeb9d1bae9fec2085b50"} {"level":"info","ts":"2026-07-28T20:41:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6c5f89f33c497cf5bb0294684e063b730ef08b196a6a991d1b53f19716f5525a"} {"level":"info","ts":"2026-07-28T20:41:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/62c30f65816f71b2a39b89022152dd1bf3326a03f875b91bc52a3678b98bb88b"}