--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0704dcd4-5f10-49a1-a75a-e88599e63487","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0704dcd4-5f10-49a1-a75a-e88599e63487","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0704dcd4-5f10-49a1-a75a-e88599e63487","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0704dcd4-5f10-49a1-a75a-e88599e63487"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"0704dcd4-5f10-49a1-a75a-e88599e63487","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":203568589,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38658","port":38658}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0704dcd4-5f10-49a1-a75a-e88599e63487","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0704dcd4-5f10-49a1-a75a-e88599e63487","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0704dcd4-5f10-49a1-a75a-e88599e63487","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0704dcd4-5f10-49a1-a75a-e88599e63487","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0704dcd4-5f10-49a1-a75a-e88599e63487","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0704dcd4-5f10-49a1-a75a-e88599e63487","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0704dcd4-5f10-49a1-a75a-e88599e63487","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0704dcd4-5f10-49a1-a75a-e88599e63487","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0704dcd4-5f10-49a1-a75a-e88599e63487","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38674","PortSpecifier":{"PortValue":38674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38674","PortSpecifier":{"PortValue":38674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":252812184},"http":{"id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":252812184,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38674","port":38674}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1a195ae-be79-4bd5-9d02-ea5aa8d34c96","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38676","PortSpecifier":{"PortValue":38676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38676","PortSpecifier":{"PortValue":38676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":302917258},"http":{"id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":302917258,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38676","port":38676}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0e187e6b-cfc2-4dd1-b3f7-02586f5ddaac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38688","PortSpecifier":{"PortValue":38688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38688","PortSpecifier":{"PortValue":38688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":353800367},"http":{"id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":353800367,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38688","port":38688}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0f3c2fca-925f-4a04-a939-835aa6bf3d8c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38696","PortSpecifier":{"PortValue":38696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38696","PortSpecifier":{"PortValue":38696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":403016644},"http":{"id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":403016644,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38696","port":38696}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6acf49ac-13e0-4b7a-be60-6ec5fc7d0ad7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38700","PortSpecifier":{"PortValue":38700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4a18854f-e8e6-4a94-9e60-aabea406acab","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38700","PortSpecifier":{"PortValue":38700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":452555062},"http":{"id":"4a18854f-e8e6-4a94-9e60-aabea406acab","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4a18854f-e8e6-4a94-9e60-aabea406acab"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"4a18854f-e8e6-4a94-9e60-aabea406acab","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":452555062,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38700","port":38700}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a18854f-e8e6-4a94-9e60-aabea406acab","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38708","PortSpecifier":{"PortValue":38708}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"66615045-f9d4-4769-bc39-8104eafe6bd2","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38708","PortSpecifier":{"PortValue":38708}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":503106930},"http":{"id":"66615045-f9d4-4769-bc39-8104eafe6bd2","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"66615045-f9d4-4769-bc39-8104eafe6bd2"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"66615045-f9d4-4769-bc39-8104eafe6bd2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":503106930,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38708","port":38708}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66615045-f9d4-4769-bc39-8104eafe6bd2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd60c768-5499-436d-9db1-f4414d529bca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38724","PortSpecifier":{"PortValue":38724}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dd60c768-5499-436d-9db1-f4414d529bca","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd60c768-5499-436d-9db1-f4414d529bca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38724","PortSpecifier":{"PortValue":38724}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":552722031},"http":{"id":"dd60c768-5499-436d-9db1-f4414d529bca","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"dd60c768-5499-436d-9db1-f4414d529bca","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dd60c768-5499-436d-9db1-f4414d529bca","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dd60c768-5499-436d-9db1-f4414d529bca","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"dd60c768-5499-436d-9db1-f4414d529bca"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"dd60c768-5499-436d-9db1-f4414d529bca","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":552722031,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38724","port":38724}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd60c768-5499-436d-9db1-f4414d529bca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd60c768-5499-436d-9db1-f4414d529bca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd60c768-5499-436d-9db1-f4414d529bca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dd60c768-5499-436d-9db1-f4414d529bca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd60c768-5499-436d-9db1-f4414d529bca","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd60c768-5499-436d-9db1-f4414d529bca","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd60c768-5499-436d-9db1-f4414d529bca","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd60c768-5499-436d-9db1-f4414d529bca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd60c768-5499-436d-9db1-f4414d529bca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38726","PortSpecifier":{"PortValue":38726}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38726","PortSpecifier":{"PortValue":38726}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":603702131},"http":{"id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":603702131,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38726","port":38726}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ef07d26-0c33-4408-9b6c-6011b3c8b375","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38732","PortSpecifier":{"PortValue":38732}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38732","PortSpecifier":{"PortValue":38732}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":653196028},"http":{"id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":653196028,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38732","port":38732}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b9c8f94-b90a-4cdd-8f1a-ac94adb725e4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d1f5dc9-4354-4094-a59e-426533790917","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38740","PortSpecifier":{"PortValue":38740}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3d1f5dc9-4354-4094-a59e-426533790917","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d1f5dc9-4354-4094-a59e-426533790917","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38740","PortSpecifier":{"PortValue":38740}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":704598852},"http":{"id":"3d1f5dc9-4354-4094-a59e-426533790917","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3d1f5dc9-4354-4094-a59e-426533790917","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3d1f5dc9-4354-4094-a59e-426533790917","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3d1f5dc9-4354-4094-a59e-426533790917","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3d1f5dc9-4354-4094-a59e-426533790917"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"3d1f5dc9-4354-4094-a59e-426533790917","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":704598852,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38740","port":38740}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d1f5dc9-4354-4094-a59e-426533790917","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d1f5dc9-4354-4094-a59e-426533790917","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d1f5dc9-4354-4094-a59e-426533790917","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3d1f5dc9-4354-4094-a59e-426533790917","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d1f5dc9-4354-4094-a59e-426533790917","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d1f5dc9-4354-4094-a59e-426533790917","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d1f5dc9-4354-4094-a59e-426533790917","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d1f5dc9-4354-4094-a59e-426533790917","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d1f5dc9-4354-4094-a59e-426533790917","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38750","PortSpecifier":{"PortValue":38750}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38750","PortSpecifier":{"PortValue":38750}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":753241542},"http":{"id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":753241542,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38750","port":38750}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4a7e5c0-372a-4ecb-8ea3-238272bcb481","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38762","PortSpecifier":{"PortValue":38762}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"181c7167-06ac-466b-904c-2d4f38c4b760","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38762","PortSpecifier":{"PortValue":38762}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":802792301},"http":{"id":"181c7167-06ac-466b-904c-2d4f38c4b760","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"181c7167-06ac-466b-904c-2d4f38c4b760"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"181c7167-06ac-466b-904c-2d4f38c4b760","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":802792301,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38762","port":38762}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"181c7167-06ac-466b-904c-2d4f38c4b760","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38774","PortSpecifier":{"PortValue":38774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38774","PortSpecifier":{"PortValue":38774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":853649878},"http":{"id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1be33c1c-2ad3-44d1-b507-1844dacb7465"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":853649878,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38774","port":38774}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1be33c1c-2ad3-44d1-b507-1844dacb7465","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38790","PortSpecifier":{"PortValue":38790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38790","PortSpecifier":{"PortValue":38790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":903454062},"http":{"id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":903454062,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38790","port":38790}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9749f6d8-05e7-4eac-88bd-bfd9a0301c89","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38792","PortSpecifier":{"PortValue":38792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38792","PortSpecifier":{"PortValue":38792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435529,"nanos":952755976},"http":{"id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4fa916f1-f35a-43e0-b2d2-7404d269886e"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":952755976,"seconds":1783435529},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38792","port":38792}}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4fa916f1-f35a-43e0-b2d2-7404d269886e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38804","PortSpecifier":{"PortValue":38804}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"44238691-1dc0-438a-8235-63c08a8d3f6d","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38804","PortSpecifier":{"PortValue":38804}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":3622907},"http":{"id":"44238691-1dc0-438a-8235-63c08a8d3f6d","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"44238691-1dc0-438a-8235-63c08a8d3f6d"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"44238691-1dc0-438a-8235-63c08a8d3f6d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":3622907,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38804","port":38804}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44238691-1dc0-438a-8235-63c08a8d3f6d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38818","PortSpecifier":{"PortValue":38818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38818","PortSpecifier":{"PortValue":38818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":53102555},"http":{"id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"01f05e12-65f1-4734-9f8a-3e530f6507e3"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":53102555,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38818","port":38818}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01f05e12-65f1-4734-9f8a-3e530f6507e3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3064694-1187-453b-9dde-66ccd01113cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38820","PortSpecifier":{"PortValue":38820}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b3064694-1187-453b-9dde-66ccd01113cf","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3064694-1187-453b-9dde-66ccd01113cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38820","PortSpecifier":{"PortValue":38820}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":102765228},"http":{"id":"b3064694-1187-453b-9dde-66ccd01113cf","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b3064694-1187-453b-9dde-66ccd01113cf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b3064694-1187-453b-9dde-66ccd01113cf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b3064694-1187-453b-9dde-66ccd01113cf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b3064694-1187-453b-9dde-66ccd01113cf"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"b3064694-1187-453b-9dde-66ccd01113cf","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":102765228,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38820","port":38820}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3064694-1187-453b-9dde-66ccd01113cf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3064694-1187-453b-9dde-66ccd01113cf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3064694-1187-453b-9dde-66ccd01113cf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b3064694-1187-453b-9dde-66ccd01113cf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3064694-1187-453b-9dde-66ccd01113cf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3064694-1187-453b-9dde-66ccd01113cf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3064694-1187-453b-9dde-66ccd01113cf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3064694-1187-453b-9dde-66ccd01113cf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3064694-1187-453b-9dde-66ccd01113cf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38826","PortSpecifier":{"PortValue":38826}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38826","PortSpecifier":{"PortValue":38826}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":152623295},"http":{"id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":152623295,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38826","port":38826}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4b226d7-8b3e-483b-80cc-071c477c7b2b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38828","PortSpecifier":{"PortValue":38828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9d4ba591-ce97-4225-9586-a5870e5cf799","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38828","PortSpecifier":{"PortValue":38828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":202691185},"http":{"id":"9d4ba591-ce97-4225-9586-a5870e5cf799","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9d4ba591-ce97-4225-9586-a5870e5cf799"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"9d4ba591-ce97-4225-9586-a5870e5cf799","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":202691185,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38828","port":38828}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d4ba591-ce97-4225-9586-a5870e5cf799","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38836","PortSpecifier":{"PortValue":38836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1db81950-faaf-4368-b6dd-bace830cd5a6","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38836","PortSpecifier":{"PortValue":38836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":252709675},"http":{"id":"1db81950-faaf-4368-b6dd-bace830cd5a6","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1db81950-faaf-4368-b6dd-bace830cd5a6"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"1db81950-faaf-4368-b6dd-bace830cd5a6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":252709675,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38836","port":38836}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1db81950-faaf-4368-b6dd-bace830cd5a6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38846","PortSpecifier":{"PortValue":38846}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5e2c52fd-67f7-438b-a421-b609a54b8130","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38846","PortSpecifier":{"PortValue":38846}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":302999680},"http":{"id":"5e2c52fd-67f7-438b-a421-b609a54b8130","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5e2c52fd-67f7-438b-a421-b609a54b8130"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"5e2c52fd-67f7-438b-a421-b609a54b8130","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":302999680,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38846","port":38846}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e2c52fd-67f7-438b-a421-b609a54b8130","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"454229e7-e529-440b-839c-c285f3ee29e2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38854","PortSpecifier":{"PortValue":38854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"454229e7-e529-440b-839c-c285f3ee29e2","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"454229e7-e529-440b-839c-c285f3ee29e2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38854","PortSpecifier":{"PortValue":38854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":352645407},"http":{"id":"454229e7-e529-440b-839c-c285f3ee29e2","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"454229e7-e529-440b-839c-c285f3ee29e2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"454229e7-e529-440b-839c-c285f3ee29e2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"454229e7-e529-440b-839c-c285f3ee29e2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"454229e7-e529-440b-839c-c285f3ee29e2"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"454229e7-e529-440b-839c-c285f3ee29e2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":352645407,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38854","port":38854}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"454229e7-e529-440b-839c-c285f3ee29e2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"454229e7-e529-440b-839c-c285f3ee29e2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"454229e7-e529-440b-839c-c285f3ee29e2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"454229e7-e529-440b-839c-c285f3ee29e2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"454229e7-e529-440b-839c-c285f3ee29e2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"454229e7-e529-440b-839c-c285f3ee29e2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"454229e7-e529-440b-839c-c285f3ee29e2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"454229e7-e529-440b-839c-c285f3ee29e2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"454229e7-e529-440b-839c-c285f3ee29e2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38864","PortSpecifier":{"PortValue":38864}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b4ddb2a2-d7c7-4861-8342-716062123b19","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38864","PortSpecifier":{"PortValue":38864}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":403594227},"http":{"id":"b4ddb2a2-d7c7-4861-8342-716062123b19","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b4ddb2a2-d7c7-4861-8342-716062123b19"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"b4ddb2a2-d7c7-4861-8342-716062123b19","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":403594227,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38864","port":38864}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b4ddb2a2-d7c7-4861-8342-716062123b19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38868","PortSpecifier":{"PortValue":38868}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38868","PortSpecifier":{"PortValue":38868}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":454108092},"http":{"id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":454108092,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38868","port":38868}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2bb4465d-7d08-46cb-98f7-d8e33e8cd871","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38872","PortSpecifier":{"PortValue":38872}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38872","PortSpecifier":{"PortValue":38872}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":502871549},"http":{"id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":502871549,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38872","port":38872}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3642b5fe-9c64-43b8-b8d9-c943e4cd6d5c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38876","PortSpecifier":{"PortValue":38876}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a73a671d-7910-4b82-b9b1-44526f892eeb","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38876","PortSpecifier":{"PortValue":38876}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":552952419},"http":{"id":"a73a671d-7910-4b82-b9b1-44526f892eeb","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a73a671d-7910-4b82-b9b1-44526f892eeb"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"a73a671d-7910-4b82-b9b1-44526f892eeb","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":552952419,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38876","port":38876}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a73a671d-7910-4b82-b9b1-44526f892eeb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38880","PortSpecifier":{"PortValue":38880}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"879492c4-f648-44f1-ba50-3d26714b27b8","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38880","PortSpecifier":{"PortValue":38880}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":605471399},"http":{"id":"879492c4-f648-44f1-ba50-3d26714b27b8","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"879492c4-f648-44f1-ba50-3d26714b27b8"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"879492c4-f648-44f1-ba50-3d26714b27b8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":605471399,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38880","port":38880}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"879492c4-f648-44f1-ba50-3d26714b27b8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38894","PortSpecifier":{"PortValue":38894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"785f9e8a-52b8-4b09-af97-867f7454c43f","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38894","PortSpecifier":{"PortValue":38894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":652079356},"http":{"id":"785f9e8a-52b8-4b09-af97-867f7454c43f","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"785f9e8a-52b8-4b09-af97-867f7454c43f"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"785f9e8a-52b8-4b09-af97-867f7454c43f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":652079356,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38894","port":38894}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"785f9e8a-52b8-4b09-af97-867f7454c43f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38906","PortSpecifier":{"PortValue":38906}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9795a2f5-6439-4e84-a86e-112d6ad11067","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38906","PortSpecifier":{"PortValue":38906}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":702040250},"http":{"id":"9795a2f5-6439-4e84-a86e-112d6ad11067","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9795a2f5-6439-4e84-a86e-112d6ad11067"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"9795a2f5-6439-4e84-a86e-112d6ad11067","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":702040250,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38906","port":38906}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9795a2f5-6439-4e84-a86e-112d6ad11067","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38914","PortSpecifier":{"PortValue":38914}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1245d332-aeb6-43f8-9b69-f955c893fe18","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38914","PortSpecifier":{"PortValue":38914}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":752606907},"http":{"id":"1245d332-aeb6-43f8-9b69-f955c893fe18","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1245d332-aeb6-43f8-9b69-f955c893fe18"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"1245d332-aeb6-43f8-9b69-f955c893fe18","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":752606907,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38914","port":38914}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1245d332-aeb6-43f8-9b69-f955c893fe18","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38920","PortSpecifier":{"PortValue":38920}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38920","PortSpecifier":{"PortValue":38920}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":804089727},"http":{"id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":804089727,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38920","port":38920}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23b4ab7c-7f59-4844-90bd-ce8cd148727a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38936","PortSpecifier":{"PortValue":38936}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e18859c2-ef79-442b-aba4-254c2d8391b9","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38936","PortSpecifier":{"PortValue":38936}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":858097225},"http":{"id":"e18859c2-ef79-442b-aba4-254c2d8391b9","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e18859c2-ef79-442b-aba4-254c2d8391b9"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"e18859c2-ef79-442b-aba4-254c2d8391b9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":858097225,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38936","port":38936}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e18859c2-ef79-442b-aba4-254c2d8391b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38952","PortSpecifier":{"PortValue":38952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38952","PortSpecifier":{"PortValue":38952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":904374233},"http":{"id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"dbd9d1ae-3027-4fba-98df-6d1769f01282"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":904374233,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38952","port":38952}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dbd9d1ae-3027-4fba-98df-6d1769f01282","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71d6a373-369c-4aa6-8425-a9665e488706","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38968","PortSpecifier":{"PortValue":38968}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"71d6a373-369c-4aa6-8425-a9665e488706","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71d6a373-369c-4aa6-8425-a9665e488706","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38968","PortSpecifier":{"PortValue":38968}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435530,"nanos":953696376},"http":{"id":"71d6a373-369c-4aa6-8425-a9665e488706","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"71d6a373-369c-4aa6-8425-a9665e488706","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"71d6a373-369c-4aa6-8425-a9665e488706","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"71d6a373-369c-4aa6-8425-a9665e488706","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"71d6a373-369c-4aa6-8425-a9665e488706"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"71d6a373-369c-4aa6-8425-a9665e488706","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":953696376,"seconds":1783435530},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38968","port":38968}}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71d6a373-369c-4aa6-8425-a9665e488706","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71d6a373-369c-4aa6-8425-a9665e488706","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71d6a373-369c-4aa6-8425-a9665e488706","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"71d6a373-369c-4aa6-8425-a9665e488706","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71d6a373-369c-4aa6-8425-a9665e488706","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71d6a373-369c-4aa6-8425-a9665e488706","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71d6a373-369c-4aa6-8425-a9665e488706","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71d6a373-369c-4aa6-8425-a9665e488706","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71d6a373-369c-4aa6-8425-a9665e488706","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38976","PortSpecifier":{"PortValue":38976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38976","PortSpecifier":{"PortValue":38976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":8339910},"http":{"id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":8339910,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38976","port":38976}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d135c8f-6df8-4ed8-9af1-eccf17d475d6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38990","PortSpecifier":{"PortValue":38990}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"62aa5738-bd33-4c96-a85a-d15da53c8302","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38990","PortSpecifier":{"PortValue":38990}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":53247159},"http":{"id":"62aa5738-bd33-4c96-a85a-d15da53c8302","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"62aa5738-bd33-4c96-a85a-d15da53c8302"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"62aa5738-bd33-4c96-a85a-d15da53c8302","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":53247159,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38990","port":38990}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"62aa5738-bd33-4c96-a85a-d15da53c8302","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38992","PortSpecifier":{"PortValue":38992}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"827006d8-5174-4c48-92ec-2bc0be49cde4","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38992","PortSpecifier":{"PortValue":38992}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":102468547},"http":{"id":"827006d8-5174-4c48-92ec-2bc0be49cde4","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"827006d8-5174-4c48-92ec-2bc0be49cde4"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"827006d8-5174-4c48-92ec-2bc0be49cde4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":102468547,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38992","port":38992}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"827006d8-5174-4c48-92ec-2bc0be49cde4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38994","PortSpecifier":{"PortValue":38994}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:38994","PortSpecifier":{"PortValue":38994}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":153853252},"http":{"id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":153853252,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:38994","port":38994}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fbb12c4-e05f-4c7c-a0b7-3beada779fcc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39006","PortSpecifier":{"PortValue":39006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f6840178-0f45-4a50-8adc-58efad82b6ee","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39006","PortSpecifier":{"PortValue":39006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":204443259},"http":{"id":"f6840178-0f45-4a50-8adc-58efad82b6ee","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f6840178-0f45-4a50-8adc-58efad82b6ee"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"f6840178-0f45-4a50-8adc-58efad82b6ee","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":204443259,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39006","port":39006}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6840178-0f45-4a50-8adc-58efad82b6ee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39016","PortSpecifier":{"PortValue":39016}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ecb2080a-20c4-43ae-b33a-1351481291ab","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39016","PortSpecifier":{"PortValue":39016}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":254184553},"http":{"id":"ecb2080a-20c4-43ae-b33a-1351481291ab","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ecb2080a-20c4-43ae-b33a-1351481291ab"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"ecb2080a-20c4-43ae-b33a-1351481291ab","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":254184553,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39016","port":39016}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ecb2080a-20c4-43ae-b33a-1351481291ab","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39028","PortSpecifier":{"PortValue":39028}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39028","PortSpecifier":{"PortValue":39028}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":304105739},"http":{"id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":304105739,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39028","port":39028}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8fcb147-bfb1-4265-a70d-01a33c01d6c4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39030","PortSpecifier":{"PortValue":39030}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39030","PortSpecifier":{"PortValue":39030}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":353316941},"http":{"id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3b17536a-38d4-459c-9af3-dffa94ad63f8"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":353316941,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39030","port":39030}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b17536a-38d4-459c-9af3-dffa94ad63f8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39044","PortSpecifier":{"PortValue":39044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39044","PortSpecifier":{"PortValue":39044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":403850950},"http":{"id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":403850950,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39044","port":39044}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af0e7e3b-d6ed-4d61-9de0-cfb9306a879c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0519305a-349c-4909-ab31-971e43627362","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39056","PortSpecifier":{"PortValue":39056}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0519305a-349c-4909-ab31-971e43627362","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0519305a-349c-4909-ab31-971e43627362","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39056","PortSpecifier":{"PortValue":39056}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":453184380},"http":{"id":"0519305a-349c-4909-ab31-971e43627362","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0519305a-349c-4909-ab31-971e43627362","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0519305a-349c-4909-ab31-971e43627362","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0519305a-349c-4909-ab31-971e43627362","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0519305a-349c-4909-ab31-971e43627362"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"0519305a-349c-4909-ab31-971e43627362","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":453184380,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39056","port":39056}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0519305a-349c-4909-ab31-971e43627362","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0519305a-349c-4909-ab31-971e43627362","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0519305a-349c-4909-ab31-971e43627362","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0519305a-349c-4909-ab31-971e43627362","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0519305a-349c-4909-ab31-971e43627362","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0519305a-349c-4909-ab31-971e43627362","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0519305a-349c-4909-ab31-971e43627362","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0519305a-349c-4909-ab31-971e43627362","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0519305a-349c-4909-ab31-971e43627362","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39070","PortSpecifier":{"PortValue":39070}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39070","PortSpecifier":{"PortValue":39070}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":503172744},"http":{"id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"874d43cc-0f9d-498b-a827-2f175ba5d74e"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":503172744,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39070","port":39070}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"874d43cc-0f9d-498b-a827-2f175ba5d74e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39082","PortSpecifier":{"PortValue":39082}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dd681ef8-287b-4a72-8501-223ed61686e0","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39082","PortSpecifier":{"PortValue":39082}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":552720215},"http":{"id":"dd681ef8-287b-4a72-8501-223ed61686e0","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"dd681ef8-287b-4a72-8501-223ed61686e0"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"dd681ef8-287b-4a72-8501-223ed61686e0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":552720215,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39082","port":39082}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd681ef8-287b-4a72-8501-223ed61686e0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39090","PortSpecifier":{"PortValue":39090}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39090","PortSpecifier":{"PortValue":39090}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":604568835},"http":{"id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4e46c9da-ae49-4ffe-b549-29afe4a67559"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":604568835,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39090","port":39090}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e46c9da-ae49-4ffe-b549-29afe4a67559","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39096","PortSpecifier":{"PortValue":39096}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39096","PortSpecifier":{"PortValue":39096}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":655446490},"http":{"id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":655446490,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39096","port":39096}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b59c84c-2220-4f52-b2bf-c93bd7823dc2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39100","PortSpecifier":{"PortValue":39100}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39100","PortSpecifier":{"PortValue":39100}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":703317163},"http":{"id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":703317163,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39100","port":39100}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5a71099-3cc5-4ff4-8640-d2277b1b57ba","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39114","PortSpecifier":{"PortValue":39114}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1c5d527a-8607-4c91-ba39-04f372f33742","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39114","PortSpecifier":{"PortValue":39114}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":754045795},"http":{"id":"1c5d527a-8607-4c91-ba39-04f372f33742","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1c5d527a-8607-4c91-ba39-04f372f33742"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"1c5d527a-8607-4c91-ba39-04f372f33742","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":754045795,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39114","port":39114}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1c5d527a-8607-4c91-ba39-04f372f33742","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39122","PortSpecifier":{"PortValue":39122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"59996f2c-63d6-4c73-868a-857bf243ae7d","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39122","PortSpecifier":{"PortValue":39122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":803202653},"http":{"id":"59996f2c-63d6-4c73-868a-857bf243ae7d","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"59996f2c-63d6-4c73-868a-857bf243ae7d"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"59996f2c-63d6-4c73-868a-857bf243ae7d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":803202653,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39122","port":39122}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59996f2c-63d6-4c73-868a-857bf243ae7d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39132","PortSpecifier":{"PortValue":39132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"87724dbe-27c7-4c14-adde-c9f762840bf8","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39132","PortSpecifier":{"PortValue":39132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":854375247},"http":{"id":"87724dbe-27c7-4c14-adde-c9f762840bf8","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"87724dbe-27c7-4c14-adde-c9f762840bf8"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"87724dbe-27c7-4c14-adde-c9f762840bf8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":854375247,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39132","port":39132}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"87724dbe-27c7-4c14-adde-c9f762840bf8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39136","PortSpecifier":{"PortValue":39136}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39136","PortSpecifier":{"PortValue":39136}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":902639431},"http":{"id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":902639431,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39136","port":39136}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6b667d1-e38e-4e1c-9cc2-e6620f7b1c8e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39150","PortSpecifier":{"PortValue":39150}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39150","PortSpecifier":{"PortValue":39150}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435531,"nanos":952669296},"http":{"id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":952669296,"seconds":1783435531},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39150","port":39150}}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9668c0f1-3be0-413c-a7a0-ad5aad1ddaa6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39160","PortSpecifier":{"PortValue":39160}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39160","PortSpecifier":{"PortValue":39160}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":3027794},"http":{"id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0362a48c-a1a0-498e-bcf5-d9874744a28b"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":3027794,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39160","port":39160}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0362a48c-a1a0-498e-bcf5-d9874744a28b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39166","PortSpecifier":{"PortValue":39166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39166","PortSpecifier":{"PortValue":39166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":53790425},"http":{"id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":53790425,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39166","port":39166}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"baeb8baa-88e5-4889-b4d5-b2e47218d3e8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39174","PortSpecifier":{"PortValue":39174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39174","PortSpecifier":{"PortValue":39174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":103153438},"http":{"id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":103153438,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39174","port":39174}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b44a5e7a-20b7-44af-907e-e9fa3228adfd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39190","PortSpecifier":{"PortValue":39190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39190","PortSpecifier":{"PortValue":39190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":153729926},"http":{"id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":153729926,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39190","port":39190}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ba64b3a-72af-43ce-90b5-d217cf4290cd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39198","PortSpecifier":{"PortValue":39198}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39198","PortSpecifier":{"PortValue":39198}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":203712892},"http":{"id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":203712892,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39198","port":39198}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff3c6c7d-1c49-9d68-8642-ef44909f2c93","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39214","PortSpecifier":{"PortValue":39214}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39214","PortSpecifier":{"PortValue":39214}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":253437063},"http":{"id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":253437063,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39214","port":39214}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d427d95-98fb-425e-8bf4-2c9f0746dee4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39222","PortSpecifier":{"PortValue":39222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39222","PortSpecifier":{"PortValue":39222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":303115983},"http":{"id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":303115983,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39222","port":39222}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fb4e8061-a4d6-4d35-83f2-d8f37126ee8f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39236","PortSpecifier":{"PortValue":39236}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d177fba6-25da-4229-a422-5ba2bd87b67e","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39236","PortSpecifier":{"PortValue":39236}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":353396282},"http":{"id":"d177fba6-25da-4229-a422-5ba2bd87b67e","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d177fba6-25da-4229-a422-5ba2bd87b67e"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"d177fba6-25da-4229-a422-5ba2bd87b67e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":353396282,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39236","port":39236}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d177fba6-25da-4229-a422-5ba2bd87b67e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39252","PortSpecifier":{"PortValue":39252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d005b442-9ef1-49b4-864d-4b65a34a8583","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39252","PortSpecifier":{"PortValue":39252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":404382110},"http":{"id":"d005b442-9ef1-49b4-864d-4b65a34a8583","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d005b442-9ef1-49b4-864d-4b65a34a8583"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"d005b442-9ef1-49b4-864d-4b65a34a8583","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":404382110,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39252","port":39252}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d005b442-9ef1-49b4-864d-4b65a34a8583","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39258","PortSpecifier":{"PortValue":39258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39258","PortSpecifier":{"PortValue":39258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":452106732},"http":{"id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":452106732,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39258","port":39258}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9144dd94-09e5-4e28-a8ea-12aa4be740f0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39262","PortSpecifier":{"PortValue":39262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39262","PortSpecifier":{"PortValue":39262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":503924000},"http":{"id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"32c6d9c3-87fc-477d-a321-e27f024f29b9"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":503924000,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39262","port":39262}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32c6d9c3-87fc-477d-a321-e27f024f29b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66650d19-b09b-4775-9215-8012e7a0b703","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39274","PortSpecifier":{"PortValue":39274}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"66650d19-b09b-4775-9215-8012e7a0b703","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66650d19-b09b-4775-9215-8012e7a0b703","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39274","PortSpecifier":{"PortValue":39274}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":552915888},"http":{"id":"66650d19-b09b-4775-9215-8012e7a0b703","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"66650d19-b09b-4775-9215-8012e7a0b703","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"66650d19-b09b-4775-9215-8012e7a0b703","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"66650d19-b09b-4775-9215-8012e7a0b703","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"66650d19-b09b-4775-9215-8012e7a0b703"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"66650d19-b09b-4775-9215-8012e7a0b703","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":552915888,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39274","port":39274}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66650d19-b09b-4775-9215-8012e7a0b703","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66650d19-b09b-4775-9215-8012e7a0b703","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66650d19-b09b-4775-9215-8012e7a0b703","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"66650d19-b09b-4775-9215-8012e7a0b703","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66650d19-b09b-4775-9215-8012e7a0b703","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66650d19-b09b-4775-9215-8012e7a0b703","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66650d19-b09b-4775-9215-8012e7a0b703","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66650d19-b09b-4775-9215-8012e7a0b703","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66650d19-b09b-4775-9215-8012e7a0b703","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39280","PortSpecifier":{"PortValue":39280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39280","PortSpecifier":{"PortValue":39280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":604565258},"http":{"id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":604565258,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39280","port":39280}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d41bdbba-7287-4fbb-922d-c80d2eda1d04","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39294","PortSpecifier":{"PortValue":39294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39294","PortSpecifier":{"PortValue":39294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":654103491},"http":{"id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":654103491,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39294","port":39294}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ad807ef-b9d4-459e-9adc-5618a1e220d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39296","PortSpecifier":{"PortValue":39296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39296","PortSpecifier":{"PortValue":39296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":703287707},"http":{"id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":703287707,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39296","port":39296}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0628902c-cfbb-4e0a-8243-4e7e3ba92f8d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39300","PortSpecifier":{"PortValue":39300}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"288142ab-b842-4fbe-82c3-0054d97621ea","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39300","PortSpecifier":{"PortValue":39300}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":753867168},"http":{"id":"288142ab-b842-4fbe-82c3-0054d97621ea","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"288142ab-b842-4fbe-82c3-0054d97621ea"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"288142ab-b842-4fbe-82c3-0054d97621ea","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":753867168,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39300","port":39300}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"288142ab-b842-4fbe-82c3-0054d97621ea","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39308","PortSpecifier":{"PortValue":39308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39308","PortSpecifier":{"PortValue":39308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":804178943},"http":{"id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":804178943,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39308","port":39308}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cfa9a1ab-7e3e-4a7f-b04f-49608ce01b74","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39320","PortSpecifier":{"PortValue":39320}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39320","PortSpecifier":{"PortValue":39320}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":853093087},"http":{"id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9aaec8bb-69aa-47bf-9e98-cd52235838df"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":853093087,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39320","port":39320}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9aaec8bb-69aa-47bf-9e98-cd52235838df","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39334","PortSpecifier":{"PortValue":39334}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39334","PortSpecifier":{"PortValue":39334}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":904752072},"http":{"id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":904752072,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39334","port":39334}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2e35d9b-8d19-4ac5-b4ed-1c496c608685","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39350","PortSpecifier":{"PortValue":39350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39350","PortSpecifier":{"PortValue":39350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435532,"nanos":953422255},"http":{"id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":953422255,"seconds":1783435532},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39350","port":39350}}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d795eb5c-6a2e-4e2c-8a13-7f555130e232","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39358","PortSpecifier":{"PortValue":39358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39358","PortSpecifier":{"PortValue":39358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":4154017},"http":{"id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"dd17c43b-650a-44d6-864a-5e294f7cc95f"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":4154017,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39358","port":39358}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd17c43b-650a-44d6-864a-5e294f7cc95f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39366","PortSpecifier":{"PortValue":39366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39366","PortSpecifier":{"PortValue":39366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":53552148},"http":{"id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":53552148,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39366","port":39366}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e7d6a32-5f63-4a8d-b798-d7e75583ec0c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39370","PortSpecifier":{"PortValue":39370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"509d7fb7-e079-4c12-a721-8d5132193e74","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39370","PortSpecifier":{"PortValue":39370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":104582526},"http":{"id":"509d7fb7-e079-4c12-a721-8d5132193e74","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"509d7fb7-e079-4c12-a721-8d5132193e74"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"509d7fb7-e079-4c12-a721-8d5132193e74","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":104582526,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39370","port":39370}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"509d7fb7-e079-4c12-a721-8d5132193e74","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39380","PortSpecifier":{"PortValue":39380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39380","PortSpecifier":{"PortValue":39380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":154332742},"http":{"id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":154332742,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39380","port":39380}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aea94ee3-ebf3-434b-ae83-2d61796ce4f0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39386","PortSpecifier":{"PortValue":39386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39386","PortSpecifier":{"PortValue":39386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":206726708},"http":{"id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":206726708,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39386","port":39386}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4f6ccf40-e2e6-4afa-8891-2d1e124c31d0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb1166aa-1957-4163-af8c-d483001ec677","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39400","PortSpecifier":{"PortValue":39400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb1166aa-1957-4163-af8c-d483001ec677","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb1166aa-1957-4163-af8c-d483001ec677","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39400","PortSpecifier":{"PortValue":39400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":254058159},"http":{"id":"cb1166aa-1957-4163-af8c-d483001ec677","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cb1166aa-1957-4163-af8c-d483001ec677","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb1166aa-1957-4163-af8c-d483001ec677","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb1166aa-1957-4163-af8c-d483001ec677","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"cb1166aa-1957-4163-af8c-d483001ec677"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"cb1166aa-1957-4163-af8c-d483001ec677","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":254058159,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39400","port":39400}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb1166aa-1957-4163-af8c-d483001ec677","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb1166aa-1957-4163-af8c-d483001ec677","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb1166aa-1957-4163-af8c-d483001ec677","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cb1166aa-1957-4163-af8c-d483001ec677","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb1166aa-1957-4163-af8c-d483001ec677","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb1166aa-1957-4163-af8c-d483001ec677","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb1166aa-1957-4163-af8c-d483001ec677","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb1166aa-1957-4163-af8c-d483001ec677","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb1166aa-1957-4163-af8c-d483001ec677","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39414","PortSpecifier":{"PortValue":39414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39414","PortSpecifier":{"PortValue":39414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":304192803},"http":{"id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":304192803,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39414","port":39414}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"260a6b0b-b4a1-41c7-ae09-20c8850875b4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39428","PortSpecifier":{"PortValue":39428}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c6a36f97-cae6-49ec-8d87-390c704384a6","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39428","PortSpecifier":{"PortValue":39428}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":354133446},"http":{"id":"c6a36f97-cae6-49ec-8d87-390c704384a6","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c6a36f97-cae6-49ec-8d87-390c704384a6"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"c6a36f97-cae6-49ec-8d87-390c704384a6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":354133446,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39428","port":39428}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6a36f97-cae6-49ec-8d87-390c704384a6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39434","PortSpecifier":{"PortValue":39434}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39434","PortSpecifier":{"PortValue":39434}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":403750632},"http":{"id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":403750632,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39434","port":39434}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"79fdaf36-cad9-49ff-9153-07f7d1ad7e62","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39446","PortSpecifier":{"PortValue":39446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39446","PortSpecifier":{"PortValue":39446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":454112234},"http":{"id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":454112234,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39446","port":39446}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab21f0cf-55fe-4cf4-a517-cbd0f41d491a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d00f6233-fc74-4099-80e3-93c45448609a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39458","PortSpecifier":{"PortValue":39458}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d00f6233-fc74-4099-80e3-93c45448609a","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d00f6233-fc74-4099-80e3-93c45448609a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39458","PortSpecifier":{"PortValue":39458}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":503791026},"http":{"id":"d00f6233-fc74-4099-80e3-93c45448609a","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d00f6233-fc74-4099-80e3-93c45448609a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d00f6233-fc74-4099-80e3-93c45448609a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d00f6233-fc74-4099-80e3-93c45448609a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d00f6233-fc74-4099-80e3-93c45448609a"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"d00f6233-fc74-4099-80e3-93c45448609a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":503791026,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39458","port":39458}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d00f6233-fc74-4099-80e3-93c45448609a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d00f6233-fc74-4099-80e3-93c45448609a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d00f6233-fc74-4099-80e3-93c45448609a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d00f6233-fc74-4099-80e3-93c45448609a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d00f6233-fc74-4099-80e3-93c45448609a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d00f6233-fc74-4099-80e3-93c45448609a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d00f6233-fc74-4099-80e3-93c45448609a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d00f6233-fc74-4099-80e3-93c45448609a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d00f6233-fc74-4099-80e3-93c45448609a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39462","PortSpecifier":{"PortValue":39462}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39462","PortSpecifier":{"PortValue":39462}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":555042958},"http":{"id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":555042958,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39462","port":39462}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c3e4b11d-0bad-4894-b71c-1b1c65721a8f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39474","PortSpecifier":{"PortValue":39474}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39474","PortSpecifier":{"PortValue":39474}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":604040501},"http":{"id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":604040501,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39474","port":39474}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5aeda5d2-19b8-4dd2-9550-28501b41cc10","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39484","PortSpecifier":{"PortValue":39484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"98d11157-e88e-4695-bf27-2e64a5e420b1","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:39484","PortSpecifier":{"PortValue":39484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":654286420},"http":{"id":"98d11157-e88e-4695-bf27-2e64a5e420b1","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"98d11157-e88e-4695-bf27-2e64a5e420b1"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"98d11157-e88e-4695-bf27-2e64a5e420b1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":654286420,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:39484","port":39484}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98d11157-e88e-4695-bf27-2e64a5e420b1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41292","PortSpecifier":{"PortValue":41292}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41292","PortSpecifier":{"PortValue":41292}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":704359340},"http":{"id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":704359340,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41292","port":41292}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5bfa28f7-619d-49ea-8b64-583bc1c079cc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41302","PortSpecifier":{"PortValue":41302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"93be51b2-b317-4052-b2cb-604e96540e0f","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41302","PortSpecifier":{"PortValue":41302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":753768320},"http":{"id":"93be51b2-b317-4052-b2cb-604e96540e0f","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"93be51b2-b317-4052-b2cb-604e96540e0f"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"93be51b2-b317-4052-b2cb-604e96540e0f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":753768320,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41302","port":41302}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93be51b2-b317-4052-b2cb-604e96540e0f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41316","PortSpecifier":{"PortValue":41316}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41316","PortSpecifier":{"PortValue":41316}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":804496477},"http":{"id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e7215445-31a3-4ba4-9413-c5c941eeeb77"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":804496477,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41316","port":41316}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7215445-31a3-4ba4-9413-c5c941eeeb77","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"138e576c-69a9-4439-8eb7-5639948c219e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41322","PortSpecifier":{"PortValue":41322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"138e576c-69a9-4439-8eb7-5639948c219e","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"138e576c-69a9-4439-8eb7-5639948c219e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41322","PortSpecifier":{"PortValue":41322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":853964928},"http":{"id":"138e576c-69a9-4439-8eb7-5639948c219e","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"138e576c-69a9-4439-8eb7-5639948c219e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"138e576c-69a9-4439-8eb7-5639948c219e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"138e576c-69a9-4439-8eb7-5639948c219e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"138e576c-69a9-4439-8eb7-5639948c219e"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"138e576c-69a9-4439-8eb7-5639948c219e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":853964928,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41322","port":41322}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"138e576c-69a9-4439-8eb7-5639948c219e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"138e576c-69a9-4439-8eb7-5639948c219e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"138e576c-69a9-4439-8eb7-5639948c219e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"138e576c-69a9-4439-8eb7-5639948c219e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"138e576c-69a9-4439-8eb7-5639948c219e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"138e576c-69a9-4439-8eb7-5639948c219e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"138e576c-69a9-4439-8eb7-5639948c219e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"138e576c-69a9-4439-8eb7-5639948c219e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"138e576c-69a9-4439-8eb7-5639948c219e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41324","PortSpecifier":{"PortValue":41324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a98f83a1-e348-4da4-bac4-6d509725a160","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41324","PortSpecifier":{"PortValue":41324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":903408747},"http":{"id":"a98f83a1-e348-4da4-bac4-6d509725a160","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a98f83a1-e348-4da4-bac4-6d509725a160"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"a98f83a1-e348-4da4-bac4-6d509725a160","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":903408747,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41324","port":41324}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a98f83a1-e348-4da4-bac4-6d509725a160","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41328","PortSpecifier":{"PortValue":41328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3da00dda-2ccc-41b6-9adc-43035697294c","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41328","PortSpecifier":{"PortValue":41328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435533,"nanos":954785944},"http":{"id":"3da00dda-2ccc-41b6-9adc-43035697294c","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3da00dda-2ccc-41b6-9adc-43035697294c"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"3da00dda-2ccc-41b6-9adc-43035697294c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":954785944,"seconds":1783435533},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41328","port":41328}}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3da00dda-2ccc-41b6-9adc-43035697294c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59e10d94-c692-462c-a82a-5bb070574b02","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41342","PortSpecifier":{"PortValue":41342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"59e10d94-c692-462c-a82a-5bb070574b02","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59e10d94-c692-462c-a82a-5bb070574b02","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41342","PortSpecifier":{"PortValue":41342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":4717908},"http":{"id":"59e10d94-c692-462c-a82a-5bb070574b02","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"59e10d94-c692-462c-a82a-5bb070574b02","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"59e10d94-c692-462c-a82a-5bb070574b02","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"59e10d94-c692-462c-a82a-5bb070574b02","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"59e10d94-c692-462c-a82a-5bb070574b02"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"59e10d94-c692-462c-a82a-5bb070574b02","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":4717908,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41342","port":41342}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59e10d94-c692-462c-a82a-5bb070574b02","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59e10d94-c692-462c-a82a-5bb070574b02","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"59e10d94-c692-462c-a82a-5bb070574b02","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"59e10d94-c692-462c-a82a-5bb070574b02","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59e10d94-c692-462c-a82a-5bb070574b02","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59e10d94-c692-462c-a82a-5bb070574b02","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"59e10d94-c692-462c-a82a-5bb070574b02","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59e10d94-c692-462c-a82a-5bb070574b02","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59e10d94-c692-462c-a82a-5bb070574b02","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41344","PortSpecifier":{"PortValue":41344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"89d06ae4-0065-4a61-8cb7-61382ac72787","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41344","PortSpecifier":{"PortValue":41344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":54322035},"http":{"id":"89d06ae4-0065-4a61-8cb7-61382ac72787","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"89d06ae4-0065-4a61-8cb7-61382ac72787"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"89d06ae4-0065-4a61-8cb7-61382ac72787","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":54322035,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41344","port":41344}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89d06ae4-0065-4a61-8cb7-61382ac72787","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41360","PortSpecifier":{"PortValue":41360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41360","PortSpecifier":{"PortValue":41360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":104612660},"http":{"id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":104612660,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41360","port":41360}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90e6703a-ec33-4f5f-9a9b-b9e12b26b63c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41368","PortSpecifier":{"PortValue":41368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41368","PortSpecifier":{"PortValue":41368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":154533174},"http":{"id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":154533174,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41368","port":41368}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12cb48e2-7f8a-4221-b78c-9f52b7c1b4d8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41380","PortSpecifier":{"PortValue":41380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"780b46b8-defe-4dde-b0e0-e841977c28e6","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41380","PortSpecifier":{"PortValue":41380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":207178918},"http":{"id":"780b46b8-defe-4dde-b0e0-e841977c28e6","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"780b46b8-defe-4dde-b0e0-e841977c28e6"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"780b46b8-defe-4dde-b0e0-e841977c28e6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":207178918,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41380","port":41380}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"780b46b8-defe-4dde-b0e0-e841977c28e6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41384","PortSpecifier":{"PortValue":41384}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41384","PortSpecifier":{"PortValue":41384}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":253930616},"http":{"id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3175abcb-ea12-4d5e-878f-13d063a1efdf"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":253930616,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41384","port":41384}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3175abcb-ea12-4d5e-878f-13d063a1efdf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41396","PortSpecifier":{"PortValue":41396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3273d3df-c806-4df0-9659-65cdd21075b2","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41396","PortSpecifier":{"PortValue":41396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":303108071},"http":{"id":"3273d3df-c806-4df0-9659-65cdd21075b2","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3273d3df-c806-4df0-9659-65cdd21075b2"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"3273d3df-c806-4df0-9659-65cdd21075b2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":303108071,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41396","port":41396}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3273d3df-c806-4df0-9659-65cdd21075b2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41398","PortSpecifier":{"PortValue":41398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c5b1e8a4-4115-4750-93e3-14ef697da828","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41398","PortSpecifier":{"PortValue":41398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":353850212},"http":{"id":"c5b1e8a4-4115-4750-93e3-14ef697da828","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c5b1e8a4-4115-4750-93e3-14ef697da828"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"c5b1e8a4-4115-4750-93e3-14ef697da828","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":353850212,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41398","port":41398}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c5b1e8a4-4115-4750-93e3-14ef697da828","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41400","PortSpecifier":{"PortValue":41400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"18fc709a-cd07-457a-91dc-e88c1647e60e","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41400","PortSpecifier":{"PortValue":41400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":404225883},"http":{"id":"18fc709a-cd07-457a-91dc-e88c1647e60e","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"18fc709a-cd07-457a-91dc-e88c1647e60e"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"18fc709a-cd07-457a-91dc-e88c1647e60e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":404225883,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41400","port":41400}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"18fc709a-cd07-457a-91dc-e88c1647e60e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41416","PortSpecifier":{"PortValue":41416}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41416","PortSpecifier":{"PortValue":41416}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":454135645},"http":{"id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e8422078-d221-46fd-9ab7-eb49a513e9ea"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":454135645,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41416","port":41416}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e8422078-d221-46fd-9ab7-eb49a513e9ea","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41422","PortSpecifier":{"PortValue":41422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41422","PortSpecifier":{"PortValue":41422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":505197387},"http":{"id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":505197387,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41422","port":41422}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bbd877eb-27f5-46e8-a22c-8707bd24a0cf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41430","PortSpecifier":{"PortValue":41430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41430","PortSpecifier":{"PortValue":41430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":553554136},"http":{"id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":553554136,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41430","port":41430}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1cd96ac4-97f0-46e3-93bb-2b0a9aa1bc7f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"795d6d46-9223-46fd-a933-033c162165f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41444","PortSpecifier":{"PortValue":41444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"795d6d46-9223-46fd-a933-033c162165f8","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"795d6d46-9223-46fd-a933-033c162165f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41444","PortSpecifier":{"PortValue":41444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":604405838},"http":{"id":"795d6d46-9223-46fd-a933-033c162165f8","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"795d6d46-9223-46fd-a933-033c162165f8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"795d6d46-9223-46fd-a933-033c162165f8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"795d6d46-9223-46fd-a933-033c162165f8"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"795d6d46-9223-46fd-a933-033c162165f8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":604405838,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41444","port":41444}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"795d6d46-9223-46fd-a933-033c162165f8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"795d6d46-9223-46fd-a933-033c162165f8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"795d6d46-9223-46fd-a933-033c162165f8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41452","PortSpecifier":{"PortValue":41452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"88b69acf-abe3-47d6-abb9-38172511cb05","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41452","PortSpecifier":{"PortValue":41452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":654162249},"http":{"id":"88b69acf-abe3-47d6-abb9-38172511cb05","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"88b69acf-abe3-47d6-abb9-38172511cb05"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"88b69acf-abe3-47d6-abb9-38172511cb05","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":654162249,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41452","port":41452}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"88b69acf-abe3-47d6-abb9-38172511cb05","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73a11df4-db51-4031-8491-d8d6914121d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41466","PortSpecifier":{"PortValue":41466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"73a11df4-db51-4031-8491-d8d6914121d2","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73a11df4-db51-4031-8491-d8d6914121d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41466","PortSpecifier":{"PortValue":41466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":704286309},"http":{"id":"73a11df4-db51-4031-8491-d8d6914121d2","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"73a11df4-db51-4031-8491-d8d6914121d2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"73a11df4-db51-4031-8491-d8d6914121d2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"73a11df4-db51-4031-8491-d8d6914121d2"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"73a11df4-db51-4031-8491-d8d6914121d2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":704286309,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41466","port":41466}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73a11df4-db51-4031-8491-d8d6914121d2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73a11df4-db51-4031-8491-d8d6914121d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73a11df4-db51-4031-8491-d8d6914121d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41468","PortSpecifier":{"PortValue":41468}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41468","PortSpecifier":{"PortValue":41468}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":754024876},"http":{"id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":754024876,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41468","port":41468}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cf23941-43ba-40d5-b7ff-4d0d62394d42","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41476","PortSpecifier":{"PortValue":41476}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41476","PortSpecifier":{"PortValue":41476}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":803855766},"http":{"id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a7df3b6c-5df4-467a-ac8a-478719ff2980"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":803855766,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41476","port":41476}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7df3b6c-5df4-467a-ac8a-478719ff2980","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41488","PortSpecifier":{"PortValue":41488}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"894a6dca-6937-400e-9abe-adbf0113f1c8","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41488","PortSpecifier":{"PortValue":41488}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":854287064},"http":{"id":"894a6dca-6937-400e-9abe-adbf0113f1c8","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"894a6dca-6937-400e-9abe-adbf0113f1c8"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"894a6dca-6937-400e-9abe-adbf0113f1c8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":854287064,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41488","port":41488}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"894a6dca-6937-400e-9abe-adbf0113f1c8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41492","PortSpecifier":{"PortValue":41492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b98172ed-e212-46a1-b03d-e698fb87dec5","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41492","PortSpecifier":{"PortValue":41492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":904578421},"http":{"id":"b98172ed-e212-46a1-b03d-e698fb87dec5","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b98172ed-e212-46a1-b03d-e698fb87dec5"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"b98172ed-e212-46a1-b03d-e698fb87dec5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":904578421,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41492","port":41492}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b98172ed-e212-46a1-b03d-e698fb87dec5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41494","PortSpecifier":{"PortValue":41494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41494","PortSpecifier":{"PortValue":41494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435534,"nanos":954175246},"http":{"id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a6ebcf5d-c636-4305-896f-c84cfba4528f"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":954175246,"seconds":1783435534},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41494","port":41494}}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6ebcf5d-c636-4305-896f-c84cfba4528f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41500","PortSpecifier":{"PortValue":41500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41500","PortSpecifier":{"PortValue":41500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":4365380},"http":{"id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a90f8741-fe79-4946-b9c4-831d3bd9e140"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":4365380,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41500","port":41500}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a90f8741-fe79-4946-b9c4-831d3bd9e140","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41510","PortSpecifier":{"PortValue":41510}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41510","PortSpecifier":{"PortValue":41510}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":54319674},"http":{"id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":54319674,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41510","port":41510}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"33f3f3bb-61bd-4e7b-b221-611ccd3ec08c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41524","PortSpecifier":{"PortValue":41524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6251f8d4-485d-4764-b08c-32b050286ea1","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41524","PortSpecifier":{"PortValue":41524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":103350235},"http":{"id":"6251f8d4-485d-4764-b08c-32b050286ea1","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6251f8d4-485d-4764-b08c-32b050286ea1"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"6251f8d4-485d-4764-b08c-32b050286ea1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":103350235,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41524","port":41524}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6251f8d4-485d-4764-b08c-32b050286ea1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41530","PortSpecifier":{"PortValue":41530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41530","PortSpecifier":{"PortValue":41530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":153465072},"http":{"id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":153465072,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41530","port":41530}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f5392aa3-5b63-4d61-aa06-e0423a8e02ab","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41544","PortSpecifier":{"PortValue":41544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1e3f5698-f962-4f55-82ce-656aedc55633","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41544","PortSpecifier":{"PortValue":41544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":204233633},"http":{"id":"1e3f5698-f962-4f55-82ce-656aedc55633","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1e3f5698-f962-4f55-82ce-656aedc55633"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"1e3f5698-f962-4f55-82ce-656aedc55633","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":204233633,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41544","port":41544}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e3f5698-f962-4f55-82ce-656aedc55633","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41558","PortSpecifier":{"PortValue":41558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41558","PortSpecifier":{"PortValue":41558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":254672918},"http":{"id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":254672918,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41558","port":41558}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abbb7d7d-56cc-4dc2-b0ae-a54bd372f210","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41568","PortSpecifier":{"PortValue":41568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"30693919-54a2-4d4d-92be-edd25d3e6d21","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41568","PortSpecifier":{"PortValue":41568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":303944139},"http":{"id":"30693919-54a2-4d4d-92be-edd25d3e6d21","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"30693919-54a2-4d4d-92be-edd25d3e6d21"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"30693919-54a2-4d4d-92be-edd25d3e6d21","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":303944139,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41568","port":41568}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30693919-54a2-4d4d-92be-edd25d3e6d21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41572","PortSpecifier":{"PortValue":41572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41572","PortSpecifier":{"PortValue":41572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":356320436},"http":{"id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":356320436,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41572","port":41572}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebc5aece-61c3-4843-aa8b-5fcf19b03158","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41588","PortSpecifier":{"PortValue":41588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8dac0002-5c94-44c7-873a-0721703d68a9","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41588","PortSpecifier":{"PortValue":41588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":404136811},"http":{"id":"8dac0002-5c94-44c7-873a-0721703d68a9","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8dac0002-5c94-44c7-873a-0721703d68a9"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"8dac0002-5c94-44c7-873a-0721703d68a9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":404136811,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41588","port":41588}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8dac0002-5c94-44c7-873a-0721703d68a9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41602","PortSpecifier":{"PortValue":41602}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ed9465ee-a4c4-4265-84a0-709f37005268","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41602","PortSpecifier":{"PortValue":41602}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":454404556},"http":{"id":"ed9465ee-a4c4-4265-84a0-709f37005268","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ed9465ee-a4c4-4265-84a0-709f37005268"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"ed9465ee-a4c4-4265-84a0-709f37005268","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":454404556,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41602","port":41602}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ed9465ee-a4c4-4265-84a0-709f37005268","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f3dab147-a167-4e98-b361-be4199bbd188","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41614","PortSpecifier":{"PortValue":41614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f3dab147-a167-4e98-b361-be4199bbd188","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f3dab147-a167-4e98-b361-be4199bbd188","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41614","PortSpecifier":{"PortValue":41614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":506726442},"http":{"id":"f3dab147-a167-4e98-b361-be4199bbd188","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f3dab147-a167-4e98-b361-be4199bbd188","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f3dab147-a167-4e98-b361-be4199bbd188","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f3dab147-a167-4e98-b361-be4199bbd188"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"f3dab147-a167-4e98-b361-be4199bbd188","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":506726442,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41614","port":41614}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3dab147-a167-4e98-b361-be4199bbd188","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f3dab147-a167-4e98-b361-be4199bbd188","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f3dab147-a167-4e98-b361-be4199bbd188","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"867e45e3-7988-4066-b607-a12e7044a102","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41620","PortSpecifier":{"PortValue":41620}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"867e45e3-7988-4066-b607-a12e7044a102","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"867e45e3-7988-4066-b607-a12e7044a102","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41620","PortSpecifier":{"PortValue":41620}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":554155115},"http":{"id":"867e45e3-7988-4066-b607-a12e7044a102","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"867e45e3-7988-4066-b607-a12e7044a102","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"867e45e3-7988-4066-b607-a12e7044a102","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"867e45e3-7988-4066-b607-a12e7044a102"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"867e45e3-7988-4066-b607-a12e7044a102","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":554155115,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41620","port":41620}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"867e45e3-7988-4066-b607-a12e7044a102","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"867e45e3-7988-4066-b607-a12e7044a102","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"867e45e3-7988-4066-b607-a12e7044a102","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41636","PortSpecifier":{"PortValue":41636}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41636","PortSpecifier":{"PortValue":41636}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":604255059},"http":{"id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f7f71bf1-532f-48db-b255-9623e9b83ec3"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":604255059,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41636","port":41636}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7f71bf1-532f-48db-b255-9623e9b83ec3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a050e748-0ac5-4437-8016-ff80222b011b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41650","PortSpecifier":{"PortValue":41650}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a050e748-0ac5-4437-8016-ff80222b011b","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a050e748-0ac5-4437-8016-ff80222b011b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41650","PortSpecifier":{"PortValue":41650}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":654124727},"http":{"id":"a050e748-0ac5-4437-8016-ff80222b011b","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a050e748-0ac5-4437-8016-ff80222b011b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a050e748-0ac5-4437-8016-ff80222b011b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a050e748-0ac5-4437-8016-ff80222b011b"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"a050e748-0ac5-4437-8016-ff80222b011b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":654124727,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41650","port":41650}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a050e748-0ac5-4437-8016-ff80222b011b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a050e748-0ac5-4437-8016-ff80222b011b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a050e748-0ac5-4437-8016-ff80222b011b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29474a93-b430-44e6-9df4-700bd28705fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41654","PortSpecifier":{"PortValue":41654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"29474a93-b430-44e6-9df4-700bd28705fc","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29474a93-b430-44e6-9df4-700bd28705fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41654","PortSpecifier":{"PortValue":41654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":704738082},"http":{"id":"29474a93-b430-44e6-9df4-700bd28705fc","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"29474a93-b430-44e6-9df4-700bd28705fc","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"29474a93-b430-44e6-9df4-700bd28705fc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"29474a93-b430-44e6-9df4-700bd28705fc"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"29474a93-b430-44e6-9df4-700bd28705fc","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":704738082,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41654","port":41654}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29474a93-b430-44e6-9df4-700bd28705fc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29474a93-b430-44e6-9df4-700bd28705fc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29474a93-b430-44e6-9df4-700bd28705fc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27830339-1004-4f79-ab63-00d469823397","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41660","PortSpecifier":{"PortValue":41660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"27830339-1004-4f79-ab63-00d469823397","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27830339-1004-4f79-ab63-00d469823397","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41660","PortSpecifier":{"PortValue":41660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":754299200},"http":{"id":"27830339-1004-4f79-ab63-00d469823397","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"27830339-1004-4f79-ab63-00d469823397","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"27830339-1004-4f79-ab63-00d469823397","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"27830339-1004-4f79-ab63-00d469823397"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"27830339-1004-4f79-ab63-00d469823397","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":754299200,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41660","port":41660}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27830339-1004-4f79-ab63-00d469823397","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27830339-1004-4f79-ab63-00d469823397","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27830339-1004-4f79-ab63-00d469823397","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41664","PortSpecifier":{"PortValue":41664}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41664","PortSpecifier":{"PortValue":41664}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":804212114},"http":{"id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":804212114,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41664","port":41664}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"589a7b01-0df8-4593-a4f2-8e9ba40d3627","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90468c86-2898-40a8-86bf-a864849e5a70","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41672","PortSpecifier":{"PortValue":41672}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"90468c86-2898-40a8-86bf-a864849e5a70","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90468c86-2898-40a8-86bf-a864849e5a70","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41672","PortSpecifier":{"PortValue":41672}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":853383265},"http":{"id":"90468c86-2898-40a8-86bf-a864849e5a70","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"90468c86-2898-40a8-86bf-a864849e5a70","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"90468c86-2898-40a8-86bf-a864849e5a70","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"90468c86-2898-40a8-86bf-a864849e5a70"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"90468c86-2898-40a8-86bf-a864849e5a70","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":853383265,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41672","port":41672}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90468c86-2898-40a8-86bf-a864849e5a70","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90468c86-2898-40a8-86bf-a864849e5a70","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90468c86-2898-40a8-86bf-a864849e5a70","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41676","PortSpecifier":{"PortValue":41676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41676","PortSpecifier":{"PortValue":41676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":904163067},"http":{"id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":904163067,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41676","port":41676}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f4d5628b-2edd-43fe-ab28-71df3ff151bb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73d0f105-af76-4bff-98a6-1b88184204df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41680","PortSpecifier":{"PortValue":41680}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"73d0f105-af76-4bff-98a6-1b88184204df","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73d0f105-af76-4bff-98a6-1b88184204df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41680","PortSpecifier":{"PortValue":41680}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435535,"nanos":954187689},"http":{"id":"73d0f105-af76-4bff-98a6-1b88184204df","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"73d0f105-af76-4bff-98a6-1b88184204df","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"73d0f105-af76-4bff-98a6-1b88184204df","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"73d0f105-af76-4bff-98a6-1b88184204df"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"73d0f105-af76-4bff-98a6-1b88184204df","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":954187689,"seconds":1783435535},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41680","port":41680}}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73d0f105-af76-4bff-98a6-1b88184204df","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73d0f105-af76-4bff-98a6-1b88184204df","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73d0f105-af76-4bff-98a6-1b88184204df","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9550c861-fa21-4879-ad70-39520aefac45","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41690","PortSpecifier":{"PortValue":41690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9550c861-fa21-4879-ad70-39520aefac45","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9550c861-fa21-4879-ad70-39520aefac45","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41690","PortSpecifier":{"PortValue":41690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":11146575},"http":{"id":"9550c861-fa21-4879-ad70-39520aefac45","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9550c861-fa21-4879-ad70-39520aefac45","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9550c861-fa21-4879-ad70-39520aefac45","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9550c861-fa21-4879-ad70-39520aefac45"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"9550c861-fa21-4879-ad70-39520aefac45","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":11146575,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41690","port":41690}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9550c861-fa21-4879-ad70-39520aefac45","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9550c861-fa21-4879-ad70-39520aefac45","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9550c861-fa21-4879-ad70-39520aefac45","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41702","PortSpecifier":{"PortValue":41702}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12435add-0208-4ba0-bf16-f61fcbd7d369","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41702","PortSpecifier":{"PortValue":41702}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":54735967},"http":{"id":"12435add-0208-4ba0-bf16-f61fcbd7d369","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"12435add-0208-4ba0-bf16-f61fcbd7d369"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"12435add-0208-4ba0-bf16-f61fcbd7d369","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":54735967,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41702","port":41702}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12435add-0208-4ba0-bf16-f61fcbd7d369","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b147939c-4f19-4599-8357-5d8480f5094d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41714","PortSpecifier":{"PortValue":41714}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b147939c-4f19-4599-8357-5d8480f5094d","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b147939c-4f19-4599-8357-5d8480f5094d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41714","PortSpecifier":{"PortValue":41714}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":104745588},"http":{"id":"b147939c-4f19-4599-8357-5d8480f5094d","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b147939c-4f19-4599-8357-5d8480f5094d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b147939c-4f19-4599-8357-5d8480f5094d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b147939c-4f19-4599-8357-5d8480f5094d"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"b147939c-4f19-4599-8357-5d8480f5094d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":104745588,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41714","port":41714}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b147939c-4f19-4599-8357-5d8480f5094d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b147939c-4f19-4599-8357-5d8480f5094d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b147939c-4f19-4599-8357-5d8480f5094d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e430313-6209-4cd7-af62-1cb06222b969","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41728","PortSpecifier":{"PortValue":41728}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9e430313-6209-4cd7-af62-1cb06222b969","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e430313-6209-4cd7-af62-1cb06222b969","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41728","PortSpecifier":{"PortValue":41728}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":154821208},"http":{"id":"9e430313-6209-4cd7-af62-1cb06222b969","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9e430313-6209-4cd7-af62-1cb06222b969","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9e430313-6209-4cd7-af62-1cb06222b969","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9e430313-6209-4cd7-af62-1cb06222b969"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"9e430313-6209-4cd7-af62-1cb06222b969","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":154821208,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41728","port":41728}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e430313-6209-4cd7-af62-1cb06222b969","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e430313-6209-4cd7-af62-1cb06222b969","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e430313-6209-4cd7-af62-1cb06222b969","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41734","PortSpecifier":{"PortValue":41734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"16694d62-a923-48f7-ab8a-b4e68648f984","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41734","PortSpecifier":{"PortValue":41734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":204985443},"http":{"id":"16694d62-a923-48f7-ab8a-b4e68648f984","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"16694d62-a923-48f7-ab8a-b4e68648f984"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"16694d62-a923-48f7-ab8a-b4e68648f984","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":204985443,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41734","port":41734}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16694d62-a923-48f7-ab8a-b4e68648f984","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41748","PortSpecifier":{"PortValue":41748}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41748","PortSpecifier":{"PortValue":41748}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":255376448},"http":{"id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":255376448,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41748","port":41748}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5eeee0ed-4097-45b8-ae95-0795e3dc2e5f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35e8832e-b485-4869-b89d-bad7412999cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41754","PortSpecifier":{"PortValue":41754}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"35e8832e-b485-4869-b89d-bad7412999cd","method":"GET","path":"/v1/models","host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35e8832e-b485-4869-b89d-bad7412999cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:41754","PortSpecifier":{"PortValue":41754}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.27:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783435536,"nanos":304532209},"http":{"id":"35e8832e-b485-4869-b89d-bad7412999cd","method":"GET","headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"35e8832e-b485-4869-b89d-bad7412999cd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"]}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"35e8832e-b485-4869-b89d-bad7412999cd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/4a3554b4b8e0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=5581abda-46cc-4dfa-b548-1b6f13507592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fb1d61bd-fc10-4aee-9d61-d2d8e2511b8c","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.27:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.47","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctODl3NTcKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.27~maas-default-gateway-openshift-default-56654dcf7-89w57.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.47","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"35e8832e-b485-4869-b89d-bad7412999cd"},"host":"maas.apps.aab75412-4996-4988-9830-4a3554b4b8e0.prod.konfluxeaas.com","id":"35e8832e-b485-4869-b89d-bad7412999cd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":304532209,"seconds":1783435536},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.47:41754","port":41754}}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35e8832e-b485-4869-b89d-bad7412999cd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35e8832e-b485-4869-b89d-bad7412999cd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T14:45:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35e8832e-b485-4869-b89d-bad7412999cd","authorized":true,"response":"OK"}